fix: restrict dashboard file access to allowed directories

This patch addresses a security vulnerability where the dashboard server could serve any file from the package root.

Changes:
- Implemented an allowlist in `src/dashboard.mjs` to restrict file access to:
  - `dashboard/`
  - `assets/`
  - `src/docs/`
  - `torch-config.json`
- Added `test/dashboard-security.test.mjs` to verify the fix and prevent regressions.

The fix ensures that sensitive files like `package.json` or source code cannot be accessed via the dashboard server.

Co-authored-by: PR0M3TH3AN <[email protected]>

src/dashboard.mjs

@@ -90,6 +90,25 @@ export async function cmdDashboard(port = DEFAULT_DASHBOARD_PORT, host = '127.0.
     const safePath = path.normalize(pathname).replace(new RegExp('^(\\.\\.[\\/\\\\])+'), '');
     let filePath = path.join(packageRoot, safePath);
 
+    // Security check: restrict access to allowed paths
+    const allowedPaths = [
+      path.join(packageRoot, 'dashboard'),
+      path.join(packageRoot, 'assets'),
+      path.join(packageRoot, 'src', 'docs'),
+      path.join(packageRoot, 'torch-config.json')
+    ];
+
+    const isAllowed = allowedPaths.some(allowedPath => {
+      const rel = path.relative(allowedPath, filePath);
+      return !rel.startsWith('..') && !path.isAbsolute(rel);
+    });
+
+    if (!isAllowed) {
+      res.writeHead(403);
+      res.end('Forbidden');
+      return;
+    }
+
     // If directory, try index.html
     let fileStat = await statSafe(filePath);
     if (fileStat && fileStat.isDirectory()) {