@db-ux/core-foundations 3.0.0 → 3.0.2

package/assets/fonts/generate-eu-fonts.ts

@@ -1,5 +1,5 @@
 import { glob } from 'glob';
-import { exec } from 'node:child_process';
+import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 
 import { dirname } from 'path';
@@ -8,12 +8,16 @@ import { fileURLToPath } from 'url';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename).replaceAll('\\', '/');
 
-const execAsync = promisify(exec);
+// Security: Using execFile instead of exec to eliminate shell injection risks
+// execFile directly executes the binary without involving a shell
+const execFileAsync = promisify(execFile);
 
 const generateFonts = async () => {
 	console.log('Generating EU fonts...');
 	try {
-		await execAsync('pyftsubset --help');
+		// Security: Using array arguments instead of concatenated string
+		// This prevents shell interpretation of special characters
+		await execFileAsync('pyftsubset', ['--help']);
 	} catch (e) {
 		console.warn(
 			'You need to install pyftsubset. Check packages/foundations/assets/fonts/README.md for more information.'
@@ -22,19 +26,28 @@ const generateFonts = async () => {
 
 	try {
 		const files = await glob(`${__dirname}/*.ttf`);
-		const commands = files.map((file) =>
-			[
-				'pyftsubset',
+
+		for (const file of files) {
+			// Security: Validate that the file is within the expected directory
+			// and has the expected extension to prevent path traversal attacks
+			if (!file.startsWith(__dirname) || !file.endsWith('.ttf')) {
+				console.warn(`Skipping potentially unsafe file path: ${file}`);
+				continue;
+			}
+
+			// Security: Arguments are passed as separate array elements
+			// No shell concatenation means no risk of command injection
+			const args = [
 				file,
 				'--layout-features=*',
 				'--flavor=woff2',
 				`--unicodes-file=${__dirname}/unicode-eu.txt`,
 				`--output-file=${file.replace('.ttf', '-EU.woff2')}`
-			].join(' ')
-		);
+			];
 
-		for (const command of commands) {
-			const { stdout, stderr } = await execAsync(command);
+			// Security: execFile provides better performance and type safety
+			// as it doesn't spawn a shell process
+			const { stdout, stderr } = await execFileAsync('pyftsubset', args);
 			if (stdout) console.log(`stdout: ${stdout}`);
 			if (stderr) console.error(`stderr: ${stderr}`);
 		}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@db-ux/core-foundations",
-  "version": "3.0.0",
+  "version": "3.0.2",
   "type": "module",
   "description": "Provides basic tokens and assets based on DB UX Design System (Version 3).",
   "repository": {
@@ -20,27 +20,27 @@
     "build:01_normalize": "npm-run-all copy-prepare:*",
     "build:02_copy": "npm run copy:scss",
     "build:03_css": "sass --no-source-map --load-path=node_modules/ --load-path=../../node_modules/ build/styles  --fatal-deprecation=mixed-decls",
-    "build:04_tailwind": "cpr tailwind build/tailwind -o",
+    "build:04_tailwind": "cpr tailwind build/tailwind --overwrite",
     "build:05_postcss": "postcss build/styles/**/*.css --replace",
     "build:05_tailwind_scss": "sass --no-source-map build/tailwind/theme --fatal-deprecation=mixed-decls",
-    "build:06_ide": "cpr ide build/ide -o",
+    "build:06_ide": "cpr ide build/ide --overwrite",
     "build:06_ts": "tsc",
-    "clean": "rm -rf build",
+    "clean": "rm --recursive --force build",
     "copy-build": "npm-run-all copy-build:*",
-    "copy-build:assets": "cpr assets ../../build-outputs/foundations/assets -o",
-    "copy-build:package.json": "cpr package.json ../../build-outputs/foundations/package.json -o",
-    "copy-build:readme": "cpr README.md ../../build-outputs/foundations/README.md -o",
-    "copy-build:web": "cpr build ../../build-outputs/foundations/build -o",
+    "copy-build:assets": "cpr assets ../../build-outputs/foundations/assets --overwrite",
+    "copy-build:package.json": "cpr package.json ../../build-outputs/foundations/package.json --overwrite",
+    "copy-build:readme": "cpr README.md ../../build-outputs/foundations/README.md --overwrite",
+    "copy-build:web": "cpr build ../../build-outputs/foundations/build --overwrite",
     "copy-prepare:icon-overview": "tsx scripts/local/generate-icon-overview.ts",
-    "copy-prepare:normalize": "cpr ../../node_modules/@csstools/normalize.css/normalize.css scss/_normalize.scss -o",
-    "copy:scss": "cpr scss build/styles -o",
+    "copy-prepare:normalize": "cpr ../../node_modules/@csstools/normalize.css/normalize.css scss/_normalize.scss --overwrite",
+    "copy:scss": "cpr scss build/styles --overwrite",
     "dev": "vite --open",
     "generate:fonts": "tsx assets/fonts/generate-eu-fonts.ts",
     "generate:icons": "tsx scripts/local/generate-icon-font.ts",
     "prebuild": "npm-run-all copy-prepare:*",
     "predev": "npm-run-all copy-prepare:*",
     "prestart": "npm-run-all copy-prepare:*",
-    "regenerate:screenshots": "npx playwright test -c ./test/playwright.config.js --update-snapshots",
+    "regenerate:screenshots": "npx playwright test --config ./test/playwright.config.js --update-snapshots",
     "start": "nodemon --config nodemon.json",
     "test:e2e": "npx playwright test --config=./test/playwright.config.js"
   },
@@ -49,15 +49,15 @@
     "@db-ux/icon-font-tools": "0.3.4",
     "@playwright/test": "1.54.1",
     "cpr": "3.0.1",
-    "cssnano": "^7.1.0",
-    "dotenv": "^17.2.0",
+    "cssnano": "7.1.0",
+    "dotenv": "17.2.0",
     "glob": "11.0.3",
     "nodemon": "3.1.10",
-    "prettier": "^3.6.2",
+    "prettier": "3.6.2",
     "sass": "1.85.0",
-    "tsx": "^4.20.3",
-    "typescript": "^5.8.3",
-    "vite": "^6.3.5"
+    "tsx": "4.20.3",
+    "typescript": "5.8.3",
+    "vite": "6.3.5"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",