aleleba/effectcraft
1
0
Fork 0
mirror of https://github.com/storytold/effectcraft.git synced 2026-10-28 03:57:44 -06:00
Code Issues Packages Projects Releases Wiki Activity

security: validate CLI paths/args in dev tools (SonarCloud S2083/S8707/S8705/S7044)

Browse Source 
Resolve and validate command-line path arguments before use, enforce HTTPS at
download sinks, and confirm path containment. Hardens local codegen/fetch tools
against path-traversal and command-argument-injection findings.
This commit is contained in:
Dylan M. Taylor
2026-10-21 17:12:58 -04:00
parent cee4c16c8a
commit 8f7d5648f1
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
examples/check-ae-ease.mjs
+4 -2
View File
@@ -5,8 +5,10 @@ import { fileURLToPath } from 'node:url';
import { spawnSync } from 'node:child_process';
const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
const cli = process.argv[2];
if (!cli || !fs.existsSync(cli)) throw new Error('Usage: node examples/check-ae-ease.mjs <aesync/server/dist/cli.js>');
const cliArg = process.argv[2];
if (!cliArg) throw new Error('Usage: node examples/check-ae-ease.mjs <aesync/server/dist/cli.js>');
const cli = path.resolve(cliArg);
if (!fs.existsSync(cli) || !fs.statSync(cli).isFile() || !cli.endsWith('.js')) throw new Error('Expected an existing .js CLI file: ' + cliArg);
const tolerance = 1e-7;
function run(command, args) {
const result = spawnSync(command, args, { cwd: root, windowsHide: true, encoding: 'utf8', maxBuffer: 8 * 1024 * 1024 });