@bytechain.cn/colamd-themes 0.3.0 → 0.3.2

package/src/export-cli.ts

@@ -2,11 +2,12 @@
  * Export CLI commands: set-theme, export-html, export-pdf, export (batch).
  *
  * These are registered onto the main Commander program in cli.ts.
+ * Uses unified error handling via CLIError and shared utility functions.
  */
 
 import { Command } from "commander";
-import { existsSync, readFileSync, readdirSync, statSync, mkdirSync } from "node:fs";
-import { join, isAbsolute, resolve, basename } from "node:path";
+import { readFileSync, readdirSync, statSync, mkdirSync } from "node:fs";
+import { join, resolve } from "node:path";
 import chalk from "chalk";
 import ora from "ora";
 import {
@@ -18,6 +19,13 @@ import {
   resolveTheme,
 } from "./theme-store.js";
 import { ColamdRenderer, type RenderInput } from "./renderer.js";
+import {
+  resolveInputPath,
+  resolveOutputPath,
+  getDocumentTitle,
+  CLIError,
+  ErrorCode,
+} from "./utils/cli-utils.js";
 
 // ── set-theme ──
 
@@ -29,54 +37,62 @@ function registerSetTheme(program: Command): void {
     .option("--css <file>", "Register as custom theme using this CSS file")
     .option("--default", "Set as the default export theme")
     .option("--remove", "Unregister a custom theme")
-    .action((name: string, options: { css?: string; default?: boolean; remove?: boolean }) => {
-      // Remove
-      if (options.remove) {
-        if (storeUnregister(name)) {
-          console.log(chalk.green(`✔ Unregistered custom theme "${name}"`));
-        } else {
-          console.log(chalk.yellow(`Theme "${name}" is not registered.`));
+    .action(async (name: string, options: { css?: string; default?: boolean; remove?: boolean }) => {
+      try {
+        // Remove
+        if (options.remove) {
+          const removed = await storeUnregister(name);
+          if (removed) {
+            console.log(chalk.green(`✔ Unregistered custom theme "${name}"`));
+          } else {
+            console.log(chalk.yellow(`Theme "${name}" is not registered.`));
+          }
+          return;
         }
-        return;
-      }
 
-      // Register custom theme
-      if (options.css) {
-        const cssPath = isAbsolute(options.css) ? options.css : resolve(process.cwd(), options.css);
-        if (!existsSync(cssPath)) {
-          console.error(chalk.red(`CSS file not found: ${cssPath}`));
-          process.exit(1);
+        // Register custom theme
+        if (options.css) {
+          const cssPath = resolveInputPath(options.css);
+          await storeRegister(name, cssPath);
+          console.log(chalk.green(`✔ Registered custom theme "${name}" → ${cssPath}`));
+          if (options.default) {
+            await storeSetDefault(name);
+            console.log(chalk.green(`✔ Set "${name}" as default theme`));
+          }
+          return;
         }
-        storeRegister(name, cssPath);
-        console.log(chalk.green(`✔ Registered custom theme "${name}" → ${cssPath}`));
-        if (options.default) {
-          storeSetDefault(name);
-          console.log(chalk.green(`✔ Set "${name}" as default theme`));
+
+        // Set as default (built-in or already registered)
+        if (!BUILTIN_THEMES.includes(name as any)) {
+          const config = await getConfig();
+          if (!(name in config.themes)) {
+            throw new CLIError(
+              `Unknown theme "${name}". ` +
+              chalk.dim(`Built-in: ${BUILTIN_THEMES.join(", ")}. `) +
+              chalk.dim("Or register a custom theme with --css <file>."),
+              ErrorCode.THEME_ERROR
+            );
+          }
         }
-        return;
-      }
 
-      // Set as default (built-in or already registered)
-      if (!BUILTIN_THEMES.includes(name as any)) {
-        const config = getConfig();
-        if (!(name in config.themes)) {
-          console.error(
-            chalk.red(`Unknown theme "${name}". `) +
-            chalk.dim(`Built-in: ${BUILTIN_THEMES.join(", ")}. `) +
-            chalk.dim("Or register a custom theme with --css <file>.")
-          );
-          process.exit(1);
+        await storeSetDefault(name);
+        console.log(chalk.green(`✔ Default theme set to "${name}"`));
+
+        // Show current config
+        const config = await getConfig();
+        console.log(chalk.dim(`\n  Default: ${config.defaultTheme}`));
+        const customs = Object.keys(config.themes);
+        if (customs.length) {
+          console.log(chalk.dim(`  Custom themes: ${customs.join(", ")}`));
+        }
+      } catch (err) {
+        if (err instanceof CLIError) {
+          console.error(chalk.red(err.message));
+          process.exit(err.code);
+        } else {
+          console.error(chalk.red(`Unexpected error: ${(err as Error).message}`));
+          process.exit(ErrorCode.UNKNOWN);
         }
-      }
-      storeSetDefault(name);
-      console.log(chalk.green(`✔ Default theme set to "${name}"`));
-
-      // Show current config
-      const config = getConfig();
-      console.log(chalk.dim(`\n  Default: ${config.defaultTheme}`));
-      const customs = Object.keys(config.themes);
-      if (customs.length) {
-        console.log(chalk.dim(`  Custom themes: ${customs.join(", ")}`));
       }
     });
 }
@@ -91,42 +107,47 @@ function registerExportHTML(program: Command): void {
     .option("-t, --theme <name>", "Theme name (built-in, custom, or CSS file path)")
     .option("-o, --output <path>", "Output HTML file path")
     .action(async (input: string, options: { theme?: string; output?: string }) => {
-      const inputPath = isAbsolute(input) ? input : resolve(process.cwd(), input);
-      if (!existsSync(inputPath)) {
-        console.error(chalk.red(`File not found: ${inputPath}`));
-        process.exit(1);
-      }
-
-      const md = readFileSync(inputPath, "utf-8");
-      const title = basename(inputPath, ".md");
-      const outputPath = options.output
-        ? (isAbsolute(options.output) ? options.output : resolve(process.cwd(), options.output))
-        : inputPath.replace(/\.md$/i, ".html");
-
-      let theme;
-      try {
-        theme = resolveTheme(options.theme);
-      } catch (err) {
-        console.error(chalk.red((err as Error).message));
-        process.exit(1);
-      }
-
-      const spinner = ora(`Rendering ${basename(inputPath)} → HTML (${theme.themeName})...`).start();
       try {
-        const { renderMarkdown } = await import("./renderer.js");
-        const result = await renderMarkdown({
-          markdown: md,
-          themeName: theme.themeName,
-          customCSS: theme.customCSS,
-          title,
-        });
-
-        const { writeFileSync } = await import("node:fs");
-        writeFileSync(outputPath, result.html, "utf-8");
-        spinner.succeed(chalk.green(`Exported: ${outputPath}`));
+        // Resolve paths using shared utilities
+        const inputPath = resolveInputPath(input);
+        const title = getDocumentTitle(inputPath);
+        const outputPath = resolveOutputPath(inputPath, options.output, ".html");
+
+        // Read markdown content
+        const md = readFileSync(inputPath, "utf-8");
+
+        // Resolve theme with async API
+        const theme = await resolveTheme(options.theme);
+
+        // Render with progress indicator
+        const spinner = ora(`Rendering ${title} → HTML (${theme.themeName})...`).start();
+        try {
+          const { renderMarkdown } = await import("./renderer.js");
+          const result = await renderMarkdown({
+            markdown: md,
+            themeName: theme.themeName,
+            customCSS: theme.customCSS,
+            title,
+          });
+
+          const { writeFileSync } = await import("node:fs");
+          writeFileSync(outputPath, result.html, "utf-8");
+          spinner.succeed(chalk.green(`Exported: ${outputPath}`));
+        } catch (renderErr) {
+          spinner.fail(chalk.red(`Export failed: ${(renderErr as Error).message}`));
+          throw new CLIError(
+            `HTML rendering failed: ${(renderErr as Error).message}`,
+            ErrorCode.RENDER_ERROR,
+            renderErr as Error
+          );
+        }
       } catch (err) {
-        spinner.fail(chalk.red(`Export failed: ${(err as Error).message}`));
-        process.exit(1);
+        if (err instanceof CLIError) {
+          process.exit(err.code);
+        } else {
+          console.error(chalk.red((err as Error).message));
+          process.exit(ErrorCode.FILE_NOT_FOUND);
+        }
       }
     });
 }
@@ -142,45 +163,59 @@ function registerExportPDF(program: Command): void {
     .option("-o, --output <path>", "Output PDF file path")
     .option("--format <size>", "Page format: A4, Letter, A3", "A4")
     .action(async (input: string, options: { theme?: string; output?: string; format?: string }) => {
-      const inputPath = isAbsolute(input) ? input : resolve(process.cwd(), input);
-      if (!existsSync(inputPath)) {
-        console.error(chalk.red(`File not found: ${inputPath}`));
-        process.exit(1);
-      }
-
-      const md = readFileSync(inputPath, "utf-8");
-      const title = basename(inputPath, ".md");
-      const outputPath = options.output
-        ? (isAbsolute(options.output) ? options.output : resolve(process.cwd(), options.output))
-        : inputPath.replace(/\.md$/i, ".pdf");
-
-      let theme;
       try {
-        theme = resolveTheme(options.theme);
-      } catch (err) {
-        console.error(chalk.red((err as Error).message));
-        process.exit(1);
-      }
+        // Resolve paths using shared utilities
+        const inputPath = resolveInputPath(input);
+        const title = getDocumentTitle(inputPath);
+        const outputPath = resolveOutputPath(inputPath, options.output, ".pdf");
+
+        // Read markdown content
+        const md = readFileSync(inputPath, "utf-8");
+
+        // Validate format option
+        const validFormats = ["A4", "Letter", "A3"];
+        if (!validFormats.includes(options.format ?? "")) {
+          throw new CLIError(
+            `Invalid page format: "${options.format}". Valid formats: ${validFormats.join(", ")}`,
+            ErrorCode.INVALID_INPUT
+          );
+        }
 
-      const spinner = ora(`Rendering ${basename(inputPath)} → PDF (${theme.themeName})...`).start();
-      try {
-        const { renderPDF } = await import("./renderer.js");
-        const pdfBuffer = await renderPDF(
-          {
-            markdown: md,
-            themeName: theme.themeName,
-            customCSS: theme.customCSS,
-            title,
-          },
-          { format: options.format as any }
-        );
+        // Resolve theme with async API
+        const theme = await resolveTheme(options.theme);
 
-        const { writeFileSync } = await import("node:fs");
-        writeFileSync(outputPath, pdfBuffer);
-        spinner.succeed(chalk.green(`Exported: ${outputPath}`));
+        // Render PDF with progress indicator
+        const spinner = ora(`Rendering ${title} → PDF (${theme.themeName})...`).start();
+        try {
+          const { renderPDF } = await import("./renderer.js");
+          const pdfBuffer = await renderPDF(
+            {
+              markdown: md,
+              themeName: theme.themeName,
+              customCSS: theme.customCSS,
+              title,
+            },
+            { format: options.format as any }
+          );
+
+          const { writeFileSync } = await import("node:fs");
+          writeFileSync(outputPath, pdfBuffer);
+          spinner.succeed(chalk.green(`Exported: ${outputPath}`));
+        } catch (renderErr) {
+          spinner.fail(chalk.red(`Export failed: ${(renderErr as Error).message}`));
+          throw new CLIError(
+            `PDF rendering failed: ${(renderErr as Error).message}`,
+            ErrorCode.RENDER_ERROR,
+            renderErr as Error
+          );
+        }
       } catch (err) {
-        spinner.fail(chalk.red(`Export failed: ${(err as Error).message}`));
-        process.exit(1);
+        if (err instanceof CLIError) {
+          process.exit(err.code);
+        } else {
+          console.error(chalk.red((err as Error).message));
+          process.exit(ErrorCode.FILE_NOT_FOUND);
+        }
       }
     });
 }
@@ -196,97 +231,117 @@ function registerExport(program: Command): void {
     .option("-t, --theme <name>", "Theme name")
     .option("-d, --output-dir <dir>", "Output directory", ".")
     .action(async (inputs: string[], options: { format?: string; theme?: string; outputDir?: string }) => {
-      // Resolve glob inputs (shell usually expands, but handle edge cases)
-      const files: string[] = [];
-      for (const input of inputs) {
-        const p = isAbsolute(input) ? input : resolve(process.cwd(), input);
-        if (existsSync(p)) {
-          if (statSync(p).isDirectory()) {
-            // Directory: include all .md files
-            const dirFiles = readdirSync(p)
-              .filter((f) => f.endsWith(".md"))
-              .map((f) => join(p, f));
-            files.push(...dirFiles);
-          } else {
-            files.push(p);
+      try {
+        // Resolve glob inputs (shell usually expands, but handle edge cases)
+        const files: string[] = [];
+        for (const input of inputs) {
+          try {
+            const p = resolveInputPath(input);
+            if (statSync(p).isDirectory()) {
+              // Directory: include all .md files
+              const dirFiles = readdirSync(p)
+                .filter((f) => f.endsWith(".md"))
+                .map((f) => join(p, f));
+              files.push(...dirFiles);
+            } else {
+              files.push(p);
+            }
+          } catch {
+            console.log(chalk.yellow(`Skipping (not found): ${input}`));
           }
-        } else {
-          console.log(chalk.yellow(`Skipping (not found): ${input}`));
         }
-      }
-
-      if (files.length === 0) {
-        console.error(chalk.red("No valid input files found."));
-        process.exit(1);
-      }
-
-      let theme;
-      try {
-        theme = resolveTheme(options.theme);
-      } catch (err) {
-        console.error(chalk.red((err as Error).message));
-        process.exit(1);
-      }
 
-      const outDir = isAbsolute(options.outputDir ?? ".")
-        ? (options.outputDir ?? ".")
-        : resolve(process.cwd(), options.outputDir ?? ".");
-      const fmt = options.format ?? "html";
-
-      // Ensure output directory exists
-      if (!existsSync(outDir)) mkdirSync(outDir, { recursive: true });
-
-      console.log(chalk.bold(`\nBatch export: ${files.length} file(s) → ${fmt.toUpperCase()}`));
-      console.log(chalk.dim(`  Theme: ${theme.themeName}`));
-      console.log(chalk.dim(`  Output: ${outDir}/\n`));
-
-      const renderer = new ColamdRenderer();
-      let success = 0;
-      let failed = 0;
+        if (files.length === 0) {
+          throw new CLIError("No valid input files found.", ErrorCode.FILE_NOT_FOUND);
+        }
 
-      try {
-        await renderer.init();
+        // Resolve theme with async API
+        const theme = await resolveTheme(options.theme);
 
-        for (const file of files) {
-          const name = basename(file, ".md");
-          const md = readFileSync(file, "utf-8");
-          const outPath = join(outDir, `${name}.${fmt === "pdf" ? "pdf" : "html"}`);
-          const spinner = ora(`  ${name}.md`).start();
+        // Setup output directory
+        const outDir = resolve(process.cwd(), options.outputDir ?? ".");
+        const fmt = options.format ?? "html";
 
-          try {
-            const input: RenderInput = {
-              markdown: md,
-              themeName: theme.themeName,
-              customCSS: theme.customCSS,
-              title: name,
-            };
+        if (!["html", "pdf"].includes(fmt)) {
+          throw new CLIError(
+            `Invalid format: "${fmt}". Supported formats: html, pdf`,
+            ErrorCode.INVALID_INPUT
+          );
+        }
 
-            if (fmt === "pdf") {
-              const pdfBuffer = await renderer.exportPDF(input);
-              const { writeFileSync } = await import("node:fs");
-              writeFileSync(outPath, pdfBuffer);
-            } else {
-              const result = await renderer.render(input);
-              const { writeFileSync } = await import("node:fs");
-              writeFileSync(outPath, result.html, "utf-8");
+        // Ensure output directory exists
+        const { existsSync: dirExists } = await import("node:fs");
+        if (!dirExists(outDir)) mkdirSync(outDir, { recursive: true });
+
+        console.log(chalk.bold(`\nBatch export: ${files.length} file(s) → ${fmt.toUpperCase()}`));
+        console.log(chalk.dim(`  Theme: ${theme.themeName}`));
+        console.log(chalk.dim(`  Output: ${outDir}/\n`));
+
+        // Initialize renderer for batch processing
+        const renderer = new ColamdRenderer();
+        let success = 0;
+        let failed = 0;
+
+        try {
+          await renderer.init();
+
+          for (const file of files) {
+            const name = getDocumentTitle(file);
+            const md = readFileSync(file, "utf-8");
+            const outPath = join(outDir, `${name}.${fmt === "pdf" ? "pdf" : "html"}`);
+            const spinner = ora(`  ${name}.md`).start();
+
+            try {
+              const input: RenderInput = {
+                markdown: md,
+                themeName: theme.themeName,
+                customCSS: theme.customCSS,
+                title: name,
+              };
+
+              if (fmt === "pdf") {
+                const pdfBuffer = await renderer.exportPDF(input);
+                const { writeFileSync } = await import("node:fs");
+                writeFileSync(outPath, pdfBuffer);
+              } else {
+                const result = await renderer.render(input);
+                const { writeFileSync } = await import("node:fs");
+                writeFileSync(outPath, result.html, "utf-8");
+              }
+
+              spinner.succeed(`${name}.${fmt === "pdf" ? "pdf" : "html"}`);
+              success++;
+            } catch (fileErr) {
+              spinner.fail(`${name}.md — ${(fileErr as Error).message}`);
+              failed++;
             }
-
-            spinner.succeed(`${name}.${fmt === "pdf" ? "pdf" : "html"}`);
-            success++;
-          } catch (err) {
-            spinner.fail(`${name}.md — ${(err as Error).message}`);
-            failed++;
           }
+        } finally {
+          await renderer.close();
         }
-      } finally {
-        await renderer.close();
-      }
 
-      console.log(
-        chalk.bold(`\nDone: ${chalk.green(`${success} exported`)}`) +
-        (failed ? chalk.red(`, ${failed} failed`) : "") +
-        "\n"
-      );
+        // Summary
+        console.log(
+          chalk.bold(`\nDone: ${chalk.green(`${success} exported`)}`) +
+          (failed ? chalk.red(`, ${failed} failed`) : "") +
+          "\n"
+        );
+
+        if (failed > 0) {
+          throw new CLIError(
+            `${failed} file(s) failed to export`,
+            ErrorCode.RENDER_ERROR
+          );
+        }
+      } catch (err) {
+        if (err instanceof CLIError) {
+          console.error(chalk.red(err.message));
+          process.exit(err.code);
+        } else {
+          console.error(chalk.red((err as Error).message));
+          process.exit(ErrorCode.UNKNOWN);
+        }
+      }
     });
 }
 

package/src/extractors/url-extractor.ts

@@ -56,11 +56,65 @@ export class UrlExtractor implements Extractor {
     return /^https?:\/\//i.test(source);
   }
 
+  /**
+   * Validate URL to prevent SSRF attacks and ensure security.
+   * - Only allows http/https protocols
+   * - Blocks private network addresses (localhost, 10.x, 172.16-31.x, 192.168.x, 169.254.x)
+   */
+  private validateUrl(url: string): void {
+    let parsed: URL;
+    try {
+      parsed = new URL(url);
+    } catch {
+      throw new Error(`Invalid URL format: ${url}`);
+    }
+
+    // Protocol whitelist
+    if (!["http:", "https:"].includes(parsed.protocol)) {
+      throw new Error(`Unsupported protocol "${parsed.protocol}". Only HTTP and HTTPS are allowed.`);
+    }
+
+    // Block private network ranges to prevent SSRF
+    const hostname = parsed.hostname.toLowerCase();
+    const isPrivate =
+      hostname === "localhost" ||
+      hostname === "127.0.0.1" ||
+      hostname === "::1" ||
+      hostname === "[::1]" ||
+      hostname.startsWith("10.") ||
+      hostname.startsWith("172.16.") ||
+      hostname.startsWith("172.17.") ||
+      hostname.startsWith("172.18.") ||
+      hostname.startsWith("172.19.") ||
+      hostname.startsWith("172.20.") ||
+      hostname.startsWith("172.21.") ||
+      hostname.startsWith("172.22.") ||
+      hostname.startsWith("172.23.") ||
+      hostname.startsWith("172.24.") ||
+      hostname.startsWith("172.25.") ||
+      hostname.startsWith("172.26.") ||
+      hostname.startsWith("172.27.") ||
+      hostname.startsWith("172.28.") ||
+      hostname.startsWith("172.29.") ||
+      hostname.startsWith("172.30.") ||
+      hostname.startsWith("172.31.") ||
+      hostname.startsWith("192.168.") ||
+      hostname.startsWith("169.254.");
+
+    if (isPrivate) {
+      throw new Error(`Private network access denied: ${hostname}. Only public URLs are allowed for security reasons.`);
+    }
+  }
+
   async extract(source: string): Promise<ThemeStyle> {
+    this.validateUrl(source);
+
     const response = await axios.get(source, {
-      headers: { "User-Agent": "ColaMD-Themes/1.0 (Theme Extractor)" },
+      headers: { "User-Agent": "Mozilla/5.0 (compatible; ColaMD-Themes/1.0)" },
       timeout: 15000,
-      maxRedirects: 5,
+      maxRedirects: 3,
+      maxContentLength: 10 * 1024 * 1024,
+      responseType: "text",
     });
 
     const contentType = String(response.headers["content-type"] || "");