@0dai-dev/cli 3.3.1 → 3.3.2

package/bin/0dai.js

@@ -8,7 +8,26 @@ const path = require("path");
 const os = require("os");
 
 const VERSION = require("../package.json").version;
-const API_URL = process.env.ODAI_API_URL || "https://api.0dai.dev";
+
+// CRITICAL: validate API_URL to prevent credential exfiltration to attacker hosts
+function _validateApiUrl(url) {
+  const DEFAULT = "https://api.0dai.dev";
+  if (!url) return DEFAULT;
+  try {
+    const u = new URL(url);
+    // Only allow https (or http for localhost during dev)
+    if (u.protocol === "https:") return url;
+    if (u.protocol === "http:" && (u.hostname === "localhost" || u.hostname === "127.0.0.1" || u.hostname === "::1")) {
+      return url;
+    }
+    console.error(`[0dai] warning: ODAI_API_URL must use https (or http://localhost). Got: ${u.protocol}//${u.hostname}. Ignoring.`);
+    return DEFAULT;
+  } catch {
+    console.error(`[0dai] warning: ODAI_API_URL is not a valid URL, ignoring`);
+    return DEFAULT;
+  }
+}
+const API_URL = _validateApiUrl(process.env.ODAI_API_URL);
 const T = process.stdout.isTTY ? "\x1b[38;2;45;212;168m" : ""; // teal
 const R = process.stdout.isTTY ? "\x1b[0m" : ""; // reset
 const D = process.stdout.isTTY ? "\x1b[2m" : ""; // dim
@@ -321,17 +340,20 @@ function mergeSettingsJson(existing, incoming) {
   } catch { return incoming; }
 }
 
-function mergeAgentsMd(existing, incoming) {
-  // If user marked as unmanaged, don't touch
-  if (existing.includes("managed: false")) return existing;
-  // If managed, update with new content but preserve user additions after managed block
-  return incoming;
-}
-
 function writeFiles(target, files) {
-  let created = 0, updated = 0, unchanged = 0, merged = 0;
+  let created = 0, updated = 0, unchanged = 0, merged = 0, skipped = 0;
+  const targetResolved = path.resolve(target);
   for (const [rel, content] of Object.entries(files)) {
-    const p = path.join(target, rel);
+    // HIGH: path traversal protection — reject absolute paths and `..` escapes
+    if (typeof rel !== "string" || !rel || path.isAbsolute(rel) || rel.split(/[/\\]/).includes("..")) {
+      skipped++;
+      continue;
+    }
+    const p = path.resolve(targetResolved, rel);
+    if (!p.startsWith(targetResolved + path.sep) && p !== targetResolved) {
+      skipped++;
+      continue;
+    }
     fs.mkdirSync(path.dirname(p), { recursive: true });
 
     let finalContent = content;
@@ -365,6 +387,7 @@ function writeFiles(target, files) {
   }
   const parts = [`${created} created`, `${updated} updated`, `${unchanged} unchanged`];
   if (merged) parts.push(`${merged} merged`);
+  if (skipped) parts.push(`${skipped} skipped (unsafe path)`);
   log(parts.join(", "));
   return created + updated;
 }
@@ -1446,9 +1469,10 @@ async function cmdAuthLogin() {
       const url = `${API_URL}/v1/auth/${method}?cli=true`;
       p.log.info(`Opening browser: ${url}`);
       try {
-        const { execSync } = require("child_process");
+        const { execFileSync } = require("child_process");
         const cmd = os.platform() === "darwin" ? "open" : os.platform() === "win32" ? "start" : "xdg-open";
-        execSync(`${cmd} "${url}"`, { stdio: "ignore" });
+        // MED: use execFileSync to avoid shell injection via URL metacharacters
+        execFileSync(cmd, [url], { stdio: "ignore" });
       } catch {
         p.log.warn(`Could not open browser. Visit manually:\n  ${url}`);
       }
@@ -1791,6 +1815,23 @@ function cmdSwarm(target, sub, args) {
       const event = args.find((_, i) => args[i-1] === "--event") || "all";
       const secret = args.find((_, i) => args[i-1] === "--secret") || "";
       if (!url || !url.startsWith("http")) { log("Usage: 0dai swarm webhook add <url> [--event task_done|task_failed|all] [--secret TOKEN]"); return; }
+      // MED: SSRF protection — block internal/metadata endpoints
+      try {
+        const u = new URL(url);
+        const host = u.hostname;
+        const BLOCKED = /^(127\.|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|169\.254\.|::1$|fc00:|fe80:|localhost$|0\.0\.0\.0$)/i;
+        if (BLOCKED.test(host) || host === "metadata.google.internal") {
+          log(`rejected: ${host} is a private/internal address (SSRF protection)`);
+          return;
+        }
+        if (u.protocol !== "https:" && u.protocol !== "http:") {
+          log(`rejected: only http/https allowed, got ${u.protocol}`);
+          return;
+        }
+      } catch {
+        log(`invalid URL: ${url}`);
+        return;
+      }
       const hooks = loadHooks();
       if (hooks.find(h => h.url === url)) { log(`already registered: ${url}`); return; }
       hooks.push({ url, event, secret: secret || undefined, added_at: new Date().toISOString() });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@0dai-dev/cli",
-  "version": "3.3.1",
+  "version": "3.3.2",
   "description": "One config layer for 5 AI agent CLIs — Claude Code, Codex, OpenCode, Gemini, Aider",
   "bin": {
     "0dai": "./bin/0dai.js"