@fazetitans/fscopy 1.1.2 → 1.1.3

package/README.md

@@ -237,6 +237,8 @@ The transform function receives:
 
 Return the transformed document, or `null` to skip it.
 
+> **Security Warning**: The `--transform` option executes arbitrary code from the specified file. Only use transform files from trusted sources. Never run transforms from untrusted or unverified files as they have full access to your system.
+
 ### Webhook Notifications
 
 Get notified when transfers complete (success or failure):
@@ -393,6 +395,14 @@ fscopy --init config.json
 4. **Retry logic** - Automatic retry with exponential backoff on failures
 5. **Subcollection discovery** - Uses `listCollections()` to find nested data
 
+## Security
+
+- **Transform files execute arbitrary code** - The `--transform` option uses dynamic imports to load and execute JavaScript/TypeScript files. Only use transform files you have written or thoroughly reviewed. Malicious transform files could access your filesystem, network, or credentials.
+
+- **Webhook URLs should use HTTPS** - fscopy warns if you use HTTP webhooks (except localhost). Webhook payloads contain project names and transfer statistics that could be sensitive.
+
+- **Credentials via ADC** - fscopy uses Google Application Default Credentials. Ensure you're authenticated with the correct account before running transfers.
+
 ## Notes
 
 - **Dry run is ON by default** - Use `-d false` for actual transfer

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@fazetitans/fscopy",
-    "version": "1.1.2",
+    "version": "1.1.3",
     "description": "Fast CLI tool to copy Firestore collections between Firebase projects with filtering, parallel transfers, and subcollection support",
     "type": "module",
     "bin": {

package/src/cli.ts

@@ -23,7 +23,7 @@ import { validateConfig } from './config/validator.js';
 import { defaults } from './config/defaults.js';
 import { generateConfigFile } from './config/generator.js';
 import { loadTransferState, saveTransferState, createInitialState, validateStateForResume, deleteTransferState } from './state/index.js';
-import { sendWebhook } from './webhook/index.js';
+import { sendWebhook, validateWebhookUrl } from './webhook/index.js';
 import { countDocuments, transferCollection, clearCollection, deleteOrphanDocuments, processInParallel, getDestCollectionPath, type TransferContext, type CountProgress } from './transfer/index.js';
 import { runInteractiveMode } from './interactive.js';
 
@@ -442,6 +442,18 @@ try {
         process.exit(1);
     }
 
+    // Validate webhook URL if configured
+    if (config.webhook) {
+        const webhookValidation = validateWebhookUrl(config.webhook);
+        if (!webhookValidation.valid) {
+            console.log(`\n❌ ${webhookValidation.warning}`);
+            process.exit(1);
+        }
+        if (webhookValidation.warning) {
+            console.log(`\n⚠️  ${webhookValidation.warning}`);
+        }
+    }
+
     // Skip confirmation in interactive mode (already confirmed by selection)
     if (!argv.yes && !argv.interactive) {
         const confirmed = await askConfirmation(config);

package/src/utils/patterns.ts

@@ -1,8 +1,9 @@
 export function matchesExcludePattern(path: string, patterns: string[]): boolean {
     for (const pattern of patterns) {
         if (pattern.includes('*')) {
-            // Convert glob pattern to regex
-            const regex = new RegExp('^' + pattern.replaceAll('*', '.*') + '$');
+            // Convert glob pattern to regex (escape special chars first, then convert * to .*)
+            const escaped = pattern.replaceAll(/[.+?^${}()|[\]\\]/g, String.raw`\$&`);
+            const regex = new RegExp('^' + escaped.replaceAll('*', '.*') + '$');
             if (regex.test(path)) return true;
         } else if (path === pattern || path.endsWith('/' + pattern)) {
             // Exact match or ends with pattern

package/src/webhook/index.ts

@@ -22,6 +22,24 @@ export function detectWebhookType(url: string): 'slack' | 'discord' | 'custom' {
     return 'custom';
 }
 
+export function validateWebhookUrl(url: string): { valid: boolean; warning?: string } {
+    try {
+        const parsed = new URL(url);
+        const isLocalhost = parsed.hostname === 'localhost' || parsed.hostname === '127.0.0.1';
+
+        if (parsed.protocol !== 'https:' && !isLocalhost) {
+            return {
+                valid: true,
+                warning: `Webhook URL uses HTTP instead of HTTPS. Data will be sent unencrypted.`,
+            };
+        }
+
+        return { valid: true };
+    } catch {
+        return { valid: false, warning: `Invalid webhook URL: ${url}` };
+    }
+}
+
 export function formatSlackPayload(payload: WebhookPayload): Record<string, unknown> {
     const status = payload.success ? ':white_check_mark: Success' : ':x: Failed';
     const mode = payload.dryRun ? ' (DRY RUN)' : '';