packages/spike/src/log.ts

@@ -59,22 +59,17 @@ export function listLogFiles(): string[] {
 }
 
 export function readLogFile(filename: string): StoredLogEvent[] {
-  const raw = readLogFileRaw(filename)
-  if (!raw) return []
-  return raw
-    .trim()
-    .split("\n")
-    .filter(Boolean)
-    .map((line) => JSON.parse(line) as StoredLogEvent)
-}
-
-export function readLogFileRaw(filename: string): string | undefined {
-  if (filename !== basename(filename)) throw new Error("Invalid filename")
+  // Reject path traversal attempts (e.g. "../../../etc/passwd")
+  if (filename !== basename(filename)) return []
   const path = `${logsDir}/${filename}`
   try {
     return readFileSync(path, "utf-8")
+      .trim()
+      .split("\n")
+      .filter(Boolean)
+      .map((line) => JSON.parse(line) as StoredLogEvent)
   } catch {
-    return
+    return []
   }
 }
 

packages/spike/src/server/index.tsx

@@ -1,7 +1,7 @@
 import { serve } from "bun"
 import { handleGiteaWebhook } from "../bridge"
 import { startDiscord } from "../discord"
-import { listLogFiles, log, readLogFileRaw } from "../log"
+import { log } from "../log"
 import { LogsPage } from "./logs"
 
 await startDiscord()
@@ -32,24 +32,7 @@ const server = serve({
       },
     },
     "/logs": {
-      GET: (req) => {
-        const accept = req.headers.get("Accept") || ""
-        const wantsRaw = !accept.includes("text/html")
-        if (!wantsRaw) return LogsPage(req)
-
-        const file = new URL(req.url).searchParams.get("file")
-        if (!file) {
-          const files = listLogFiles()
-          return Response.json(files)
-        }
-        try {
-          const raw = readLogFileRaw(file)
-          if (!raw) return new Response("Not found", { status: 404 })
-          return new Response(raw, { headers: { "Content-Type": "application/jsonl" } })
-        } catch {
-          return new Response("Internal server error", { status: 500 })
-        }
-      },
+      GET: (req) => LogsPage(req),
     },
     "/discord/auth": async () => {
       const permissions = 536870912 // from https://discord.com/developers/applications