fix: harden self-hosting and repository tools

Mono-RevId: 6df559943fc3405b2933bc652111a55634090cad

Author: carderne

.github/workflows/docs.yml

@@ -5,10 +5,12 @@ on:
     branches:
       - main
     paths:
+      - ".github/workflows/docs.yml"
       - "docs/**"
   pull_request:
     types: [opened, synchronize, reopened]
     paths:
+      - ".github/workflows/docs.yml"
       - "docs/**"
 
 concurrency:
@@ -30,15 +32,22 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: 📦 Cache npm
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.npm
-          key: |
-            ${{ runner.os }}-mintlify
-          restore-keys: |
-            ${{ runner.os }}-mintlify
+      - name: 📦 Install Mintlify
+        working-directory: ${{ runner.temp }}
+        env:
+          COREPACK_HOME: ${{ runner.temp }}/mintlify-corepack
+          NPM_CONFIG_CACHE: ${{ runner.temp }}/mintlify-npm-cache
+          NPM_CONFIG_GLOBALCONFIG: /dev/null
+          NPM_CONFIG_USERCONFIG: /dev/null
+          PNPM_HOME: ${{ runner.temp }}/mintlify-pnpm
+        run: |
+          mkdir -p "$RUNNER_TEMP/mintlify-tool"
+          printf '{"private":true}\n' >"$RUNNER_TEMP/mintlify-tool/package.json"
+          corepack pnpm@10.33.2 --dir "$RUNNER_TEMP/mintlify-tool" add \
+            --save-exact \
+            --store-dir "$RUNNER_TEMP/mintlify-pnpm-store" \
+            --registry=https://registry.npmjs.org/ \
+            mintlify@4.0.393
 
       - name: 🔗 Check for broken links
-        run: npx mintlify@4.0.393 broken-links
+        run: '"$RUNNER_TEMP/mintlify-tool/node_modules/.bin/mintlify" broken-links'

hosting/docker/generate-secrets.sh

@@ -6,6 +6,7 @@
 # everyone out, or break an already-initialised datastore volume - so rotation is
 # opt-in only, via --force (which WILL break existing data/sessions).
 set -eu
+umask 077
 
 FORCE=0
 for arg in "$@"; do
@@ -35,6 +36,11 @@ if [ ! -f "$env_file" ]; then
     cp "$env_example" "$env_file"
     echo "Created $(basename "$env_file") from $(basename "$env_example")"
 fi
+chmod 600 "$env_file"
+
+if [ -f "$htpasswd_file" ]; then
+    chmod 600 "$htpasswd_file"
+fi
 
 sed_inplace() {
     if [ "$(uname)" = "Darwin" ]; then
@@ -97,7 +103,9 @@ if [ "$FORCE" -eq 1 ] || [ -z "$(current_value DOCKER_REGISTRY_PASSWORD)" ]; the
         echo "ERROR: docker is required to hash the registry password (bcrypt). Install docker and re-run." >&2
         exit 1
     fi
-    docker run --rm httpd:2 htpasswd -Bbn "$registry_user" "$registry_pass" >"$htpasswd_file"
+    printf '%s\n' "$registry_pass" \
+        | docker run --rm -i httpd:2 htpasswd -Bni "$registry_user" >"$htpasswd_file"
+    chmod 600 "$htpasswd_file"
     set_var DOCKER_REGISTRY_PASSWORD "$registry_pass"
     echo "Generated DOCKER_REGISTRY_PASSWORD (and wrote $(basename "$htpasswd_file"))"
     generated=$((generated + 1))

scripts/unpack-worker.js

@@ -32,14 +32,30 @@ try {
 
   const id = data.id;
 
+  // The id becomes the extraction root, so it must be a single path component.
+  if (
+    typeof id !== "string" ||
+    id.length === 0 ||
+    id === "." ||
+    id === ".." ||
+    id.includes("/") ||
+    id.includes("\\") ||
+    id.includes("\0")
+  ) {
+    throw new Error(`Unsafe worker id: ${id}`);
+  }
+
   console.log(`Extracting files for: ${id} to ${destDir}`);
 
   destDir = path.join(destDir, id);
 
   console.log(`Extracting files to: ${destDir}`);
 
+  // Resolve the extraction root once so we can keep every file inside it.
+  const extractionRoot = path.resolve(destDir);
+
   // Create the destination directory if it doesn't exist
-  fs.mkdirSync(destDir, { recursive: true });
+  fs.mkdirSync(extractionRoot, { recursive: true });
 
   // Process each item in the array
   const sourceFiles = data.metadata.sourceFiles;
@@ -49,7 +65,12 @@ try {
     const decompressedContent = decompressContent(file.contents);
 
     // Combine destination directory with file path
-    const fullPath = path.join(destDir, file.filePath);
+    const fullPath = path.resolve(extractionRoot, file.filePath);
+
+    // Reject any path that escapes the extraction root (zip-slip via ../ etc.)
+    if (fullPath !== extractionRoot && !fullPath.startsWith(extractionRoot + path.sep)) {
+      throw new Error(`Refusing to write outside destination: ${file.filePath}`);
+    }
 
     // Create directory structure if it doesn't exist
     const dirPath = path.dirname(fullPath);
@@ -61,7 +82,7 @@ try {
     console.log(`Created file: ${fullPath}`);
   });
 
-  console.log(`\nAll files have been extracted to: ${destDir}`);
+  console.log(`\nAll files have been extracted to: ${extractionRoot}`);
 } catch (error) {
   console.error(error);
   process.exit(1);