@lizard-build/cli 4.0.60 → 4.0.62

package/src/lib/lizard-git.ts

@@ -11,8 +11,23 @@ import { apiErrorFrom, clientHeaders, getRequestToken, APIError } from "./api.js
 
 export const DEFAULT_GIT_URL = "https://git.lizard.build";
 
+/**
+ * Where Lizard Git is. LIZARD_GIT_URL must be https (or http on this machine): the Lizard
+ * sign-in goes there with every request.
+ */
 export function gitURL(): string {
-  return (process.env.LIZARD_GIT_URL || DEFAULT_GIT_URL).replace(/\/+$/, "");
+  const u = (process.env.LIZARD_GIT_URL || DEFAULT_GIT_URL).replace(/\/+$/, "");
+  let parsed: URL;
+  try {
+    parsed = new URL(u);
+  } catch {
+    throw new APIError(400, `LIZARD_GIT_URL is not a URL: ${u}`);
+  }
+  const local = ["localhost", "127.0.0.1", "[::1]"].includes(parsed.hostname);
+  if (parsed.protocol !== "https:" && !(parsed.protocol === "http:" && local)) {
+    throw new APIError(400, `LIZARD_GIT_URL must be https:// (your Lizard sign-in is sent there), got ${u}`);
+  }
+  return u;
 }
 
 /** The credential Lizard Git gets: LIZARD_GIT_TOKEN, else the CLI's sign-in. */
@@ -61,7 +76,12 @@ export function qs(path: string, values: Record<string, string | number | boolea
 }
 
 export const seg = encodeURIComponent;
-export const segs = (p: string) => p.split("/").map(seg).join("/");
+/** A branch or file path, each part escaped; . and .. parts refused (they'd reach other URLs). */
+export const segs = (p: string) => {
+  const parts = p.split("/");
+  if (parts.some((x) => x === "" || x === "." || x === "..")) throw new APIError(400, `bad path: ${p}`);
+  return parts.map(seg).join("/");
+};
 
 let me: { login: string } | null = null;
 /** Your Lizard Git login. */
@@ -74,7 +94,7 @@ export async function myLogin(): Promise<string> {
 export function repoFromRemote(url: string, base = gitURL()): string | null {
   const host = new URL(base).host;
   const m = url.trim().match(/^(?:https?:\/\/)(?:[^@/]+@)?([^/]+)\/([^/]+)\/([^/]+?)(?:\.git)?\/?$/);
-  if (!m || m[1] !== host) return null;
+  if (!m || m[1] !== host || [m[2], m[3]].some((x) => x === "." || x === "..")) return null;
   return `${m[2]}/${m[3]}`;
 }
 
@@ -98,8 +118,9 @@ function originRepo(): string | null {
 export async function resolveRepo(flag?: string): Promise<string> {
   if (flag) {
     const f = flag.replace(/\.git$/, "");
-    if (/^[^/\s]+\/[^/\s]+$/.test(f)) return f;
-    if (/^[^/\s]+$/.test(f)) return `${await myLogin()}/${f}`;
+    const ok = (x: string) => /^[A-Za-z0-9._-]+$/.test(x) && x !== "." && x !== "..";
+    if (/^[^/\s]+\/[^/\s]+$/.test(f) && f.split("/").every(ok)) return f;
+    if (ok(f)) return `${await myLogin()}/${f}`;
     throw new APIError(400, `--repo is owner/name or name, got "${flag}"`);
   }
   const r = originRepo();

package/src/lib/updater.ts

@@ -5,7 +5,7 @@ import { join, dirname } from "node:path";
 import os from "node:os";
 import { spawn } from "node:child_process";
 
-export const CURRENT_VERSION = "4.0.60";
+export const CURRENT_VERSION = "4.0.62";
 const RELEASES_API = "https://api.github.com/repos/lizard-build/lizard-cli/releases/latest";
 const RELEASE_BASE = "https://github.com/lizard-build/lizard-cli/releases/latest/download";
 

package/test/unit/lizard-git.test.ts

@@ -1,5 +1,5 @@
 import { describe, it, expect, afterEach, vi } from "vitest";
-import { repoFromRemote, qs, gitURL, helperCommand, resolveRepo, lg } from "../../src/lib/lizard-git.js";
+import { repoFromRemote, qs, gitURL, helperCommand, resolveRepo, lg, segs } from "../../src/lib/lizard-git.js";
 
 afterEach(() => {
   vi.unstubAllGlobals();
@@ -46,3 +46,20 @@ describe("lizard git helpers", () => {
     await expect(lg.get("/api/repos/a/b")).rejects.toMatchObject({ status: 404, message: "no such repository" });
   });
 });
+
+describe("lizard git safety", () => {
+  it("refuses a LIZARD_GIT_URL that would send the sign-in in clear text", () => {
+    vi.stubEnv("LIZARD_GIT_URL", "http://evil.example");
+    expect(() => gitURL()).toThrow(/https/);
+    vi.stubEnv("LIZARD_GIT_URL", "http://127.0.0.1:8080");
+    expect(gitURL()).toBe("http://127.0.0.1:8080");
+  });
+
+  it("refuses . and .. in repository names and paths", async () => {
+    await expect(resolveRepo("../x")).rejects.toThrow();
+    await expect(resolveRepo("a/..")).rejects.toThrow();
+    expect(() => segs("../../api/user/tokens")).toThrow(/bad path/);
+    expect(segs("src/a b.js")).toBe("src/a%20b.js");
+    expect(repoFromRemote("https://git.lizard.build/../x.git")).toBeNull();
+  });
+});