@mintlify/cli 4.0.1193 → 4.0.1195

package/__test__/helpers.test.ts

@@ -1,6 +1,6 @@
 import { LOCAL_LINKED_CLI_VERSION } from '@mintlify/previewing';
 
-import { getCliVersion } from '../src/helpers.js';
+import { assertValidPackageName, getCliVersion } from '../src/helpers.js';
 
 describe('getCliVersion', () => {
   const originalTestMode = process.env.CLI_TEST_MODE;
@@ -27,3 +27,26 @@ describe('getCliVersion', () => {
     }
   );
 });
+
+describe('assertValidPackageName', () => {
+  it.each(['mint', 'mintlify', '@mintlify/cli', 'some-pkg.name~2'])(
+    'accepts valid npm package name %s',
+    (name) => {
+      expect(() => assertValidPackageName(name)).not.toThrow();
+    }
+  );
+
+  it.each([
+    'mint; rm -rf /',
+    'mint && calc.exe',
+    'mint | whoami',
+    'mint`whoami`',
+    'mint$(whoami)',
+    'mint @latest',
+    '../mint',
+    'Mint',
+    '',
+  ])('rejects %s', (name) => {
+    expect(() => assertValidPackageName(name)).toThrow('Invalid package name');
+  });
+});

package/__test__/update.test.ts

@@ -1,6 +1,11 @@
 import * as previewing from '@mintlify/previewing';
 
-import { getLatestCliVersion, getVersions, execAsync } from '../src/helpers.js';
+import {
+  getLatestCliVersion,
+  getVersions,
+  execFileAsync,
+  windowsCompatibleSpawnOptions,
+} from '../src/helpers.js';
 import { update } from '../src/update.js';
 
 vi.mock('@mintlify/previewing', async () => {
@@ -19,7 +24,7 @@ vi.mock('../src/helpers.js', async () => {
     await vi.importActual<typeof import('../src/helpers.js')>('../src/helpers.js');
   return {
     ...originalModule,
-    execAsync: vi.fn(),
+    execFileAsync: vi.fn(),
     getLatestCliVersion: vi.fn(),
     getVersions: vi.fn().mockReturnValue({
       cli: '1.0.0',
@@ -46,12 +51,16 @@ describe('update', () => {
       client: '1.0.0',
     });
     vi.mocked(getLatestCliVersion).mockReturnValue('2.0.0');
-    vi.mocked(execAsync).mockResolvedValue({ stdout: '', stderr: '' });
+    vi.mocked(execFileAsync).mockResolvedValue({ stdout: '', stderr: '' });
     vi.mocked(previewing.downloadTargetMint).mockResolvedValue();
 
     await update({ packageName: 'mintlify' });
 
-    expect(execAsync).toHaveBeenCalledWith('npm install -g mintlify@latest --silent');
+    expect(execFileAsync).toHaveBeenCalledWith(
+      'npm',
+      ['install', '-g', 'mintlify@latest', '--silent'],
+      windowsCompatibleSpawnOptions
+    );
     expect(previewing.downloadTargetMint).toHaveBeenCalledWith({
       targetVersion: '2.0.0',
       existingVersion: '1.0.0',
@@ -74,7 +83,7 @@ describe('update', () => {
 
     await update({ packageName: 'mintlify' });
 
-    expect(execAsync).not.toHaveBeenCalled();
+    expect(execFileAsync).not.toHaveBeenCalled();
     expect(previewing.downloadTargetMint).not.toHaveBeenCalled();
     expect(addLogSpy).toHaveBeenCalledWith(
       expect.objectContaining({ props: { message: 'already up to date' } })
@@ -87,7 +96,7 @@ describe('update', () => {
       client: '1.0.0',
     });
     vi.mocked(getLatestCliVersion).mockReturnValue('2.0.0');
-    vi.mocked(execAsync).mockRejectedValue(new Error('Update failed'));
+    vi.mocked(execFileAsync).mockRejectedValue(new Error('Update failed'));
 
     await update({ packageName: 'mintlify' });
 

package/bin/helpers.js

@@ -16,7 +16,7 @@ import detect from 'detect-port';
 import fse from 'fs-extra';
 import inquirer from 'inquirer';
 import yaml from 'js-yaml';
-import { exec, execSync } from 'node:child_process';
+import { execFile, execFileSync } from 'node:child_process';
 import { readFileSync } from 'node:fs';
 import fs from 'node:fs/promises';
 import { createRequire } from 'node:module';
@@ -149,11 +149,24 @@ export const getVersions = (packageName) => {
     const client = getClientVersion().trim();
     return { cli, client };
 };
+// On Windows, npm/pnpm entrypoints are .cmd shims that Node refuses to spawn
+// without a shell (EINVAL since the CVE-2024-27980 fix). Everywhere else we
+// keep the shell disabled so arguments can't be interpreted as shell syntax.
+export const windowsCompatibleSpawnOptions = {
+    shell: process.platform === 'win32',
+};
+// npm package name grammar (optionally scoped). Rejecting anything else before
+// it reaches a package-manager spawn keeps the win32 shell path (above) safe
+// from shell metacharacters.
+const VALID_PACKAGE_NAME_PATTERN = /^(@[a-z0-9~-][a-z0-9._~-]*\/)?[a-z0-9~-][a-z0-9._~-]*$/;
+export const assertValidPackageName = (packageName) => {
+    if (!VALID_PACKAGE_NAME_PATTERN.test(packageName)) {
+        throw new Error(`Invalid package name: ${packageName}`);
+    }
+};
 export const getLatestCliVersion = (packageName) => {
-    return execSync(`npm view ${packageName} version --silent`, {
-        encoding: 'utf-8',
-        stdio: ['pipe', 'pipe', 'pipe'],
-    }).trim();
+    assertValidPackageName(packageName);
+    return execFileSync('npm', ['view', packageName, 'version', '--silent'], Object.assign({ encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] }, windowsCompatibleSpawnOptions)).trim();
 };
 export const suppressConsoleWarnings = () => {
     // Ignore tailwind warnings and punycode deprecation warning
@@ -191,13 +204,14 @@ export const terminate = (code) => __awaiter(void 0, void 0, void 0, function* (
     yield shutdownPostHog();
     process.exit(code);
 });
-export const execAsync = promisify(exec);
+export const execFileAsync = promisify(execFile);
 export function isAI() {
     return (!process.stdin.isTTY || process.env.CLAUDECODE === '1' || process.env.TERM_PROGRAM === 'claude');
 }
 export const detectPackageManager = (_a) => __awaiter(void 0, [_a], void 0, function* ({ packageName }) {
+    assertValidPackageName(packageName);
     try {
-        const { stdout: packagePath } = yield execAsync(`which ${packageName}`);
+        const { stdout: packagePath } = yield execFileAsync('which', [packageName]);
         if (packagePath.includes('pnpm')) {
             return 'pnpm';
         }