@mintlify/cli 4.0.1194 → 4.0.1195

package/bin/update.js

@@ -9,8 +9,9 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 import { jsx as _jsx } from "react/jsx-runtime";
 import { SpinnerLog, SuccessLog, ErrorLog, addLog, addErrorLog, clearLogs, getLatestClientVersion, downloadTargetMint, getClientVersion, } from '@mintlify/previewing';
-import { execAsync, getLatestCliVersion, getVersions, detectPackageManager } from './helpers.js';
+import { assertValidPackageName, execFileAsync, getLatestCliVersion, getVersions, detectPackageManager, windowsCompatibleSpawnOptions, } from './helpers.js';
 export const update = (_a) => __awaiter(void 0, [_a], void 0, function* ({ packageName }) {
+    assertValidPackageName(packageName);
     addLog(_jsx(SpinnerLog, { message: "updating..." }));
     const { cli: existingCliVersion } = getVersions(packageName);
     const latestCliVersion = getLatestCliVersion(packageName);
@@ -21,10 +22,10 @@ export const update = (_a) => __awaiter(void 0, [_a], void 0, function* ({ packa
             clearLogs();
             addLog(_jsx(SpinnerLog, { message: `updating ${packageName} package...` }));
             if (packageManager === 'pnpm') {
-                yield execAsync(`pnpm install -g ${packageName}@latest --silent`);
+                yield execFileAsync('pnpm', ['install', '-g', `${packageName}@latest`, '--silent'], windowsCompatibleSpawnOptions);
             }
             else {
-                yield execAsync(`npm install -g ${packageName}@latest --silent`);
+                yield execFileAsync('npm', ['install', '-g', `${packageName}@latest`, '--silent'], windowsCompatibleSpawnOptions);
             }
         }
         catch (err) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mintlify/cli",
-  "version": "4.0.1194",
+  "version": "4.0.1195",
   "description": "The Mintlify CLI",
   "engines": {
     "node": ">=18.0.0"
@@ -46,10 +46,10 @@
   "dependencies": {
     "@inquirer/prompts": "7.9.0",
     "@mintlify/common": "1.0.921",
-    "@mintlify/link-rot": "3.0.1101",
+    "@mintlify/link-rot": "3.0.1102",
     "@mintlify/models": "0.0.315",
-    "@mintlify/prebuild": "1.0.1065",
-    "@mintlify/previewing": "4.0.1126",
+    "@mintlify/prebuild": "1.0.1066",
+    "@mintlify/previewing": "4.0.1127",
     "@mintlify/validation": "0.1.719",
     "adm-zip": "0.5.16",
     "chalk": "5.2.0",
@@ -94,5 +94,5 @@
     "vitest": "2.1.9",
     "vitest-mock-process": "1.0.4"
   },
-  "gitHead": "ee67037982b7ee4bf4c9b9f0a7b6be1fa12b8011"
+  "gitHead": "fe377420c6f347b1c823d6b475ea6f075701506e"
 }

package/src/helpers.tsx

@@ -16,7 +16,7 @@ import detect from 'detect-port';
 import fse from 'fs-extra';
 import inquirer from 'inquirer';
 import yaml from 'js-yaml';
-import { exec, execSync } from 'node:child_process';
+import { execFile, execFileSync } from 'node:child_process';
 import { readFileSync } from 'node:fs';
 import fs from 'node:fs/promises';
 import { createRequire } from 'node:module';
@@ -174,10 +174,30 @@ export const getVersions = (
   return { cli, client };
 };
 
+// On Windows, npm/pnpm entrypoints are .cmd shims that Node refuses to spawn
+// without a shell (EINVAL since the CVE-2024-27980 fix). Everywhere else we
+// keep the shell disabled so arguments can't be interpreted as shell syntax.
+export const windowsCompatibleSpawnOptions = {
+  shell: process.platform === 'win32',
+};
+
+// npm package name grammar (optionally scoped). Rejecting anything else before
+// it reaches a package-manager spawn keeps the win32 shell path (above) safe
+// from shell metacharacters.
+const VALID_PACKAGE_NAME_PATTERN = /^(@[a-z0-9~-][a-z0-9._~-]*\/)?[a-z0-9~-][a-z0-9._~-]*$/;
+
+export const assertValidPackageName = (packageName: string): void => {
+  if (!VALID_PACKAGE_NAME_PATTERN.test(packageName)) {
+    throw new Error(`Invalid package name: ${packageName}`);
+  }
+};
+
 export const getLatestCliVersion = (packageName: string) => {
-  return execSync(`npm view ${packageName} version --silent`, {
+  assertValidPackageName(packageName);
+  return execFileSync('npm', ['view', packageName, 'version', '--silent'], {
     encoding: 'utf-8',
     stdio: ['pipe', 'pipe', 'pipe'],
+    ...windowsCompatibleSpawnOptions,
   }).trim();
 };
 
@@ -222,7 +242,7 @@ export const terminate = async (code: number) => {
   process.exit(code);
 };
 
-export const execAsync = promisify(exec);
+export const execFileAsync = promisify(execFile);
 
 export function isAI(): boolean {
   return (
@@ -231,8 +251,9 @@ export function isAI(): boolean {
 }
 
 export const detectPackageManager = async ({ packageName }: { packageName: string }) => {
+  assertValidPackageName(packageName);
   try {
-    const { stdout: packagePath } = await execAsync(`which ${packageName}`);
+    const { stdout: packagePath } = await execFileAsync('which', [packageName]);
     if (packagePath.includes('pnpm')) {
       return 'pnpm';
     } else {

package/src/update.tsx

@@ -10,9 +10,17 @@ import {
   getClientVersion,
 } from '@mintlify/previewing';
 
-import { execAsync, getLatestCliVersion, getVersions, detectPackageManager } from './helpers.js';
+import {
+  assertValidPackageName,
+  execFileAsync,
+  getLatestCliVersion,
+  getVersions,
+  detectPackageManager,
+  windowsCompatibleSpawnOptions,
+} from './helpers.js';
 
 export const update = async ({ packageName }: { packageName: string }) => {
+  assertValidPackageName(packageName);
   addLog(<SpinnerLog message="updating..." />);
   const { cli: existingCliVersion } = getVersions(packageName);
   const latestCliVersion = getLatestCliVersion(packageName);
@@ -26,9 +34,17 @@ export const update = async ({ packageName }: { packageName: string }) => {
       addLog(<SpinnerLog message={`updating ${packageName} package...`} />);
 
       if (packageManager === 'pnpm') {
-        await execAsync(`pnpm install -g ${packageName}@latest --silent`);
+        await execFileAsync(
+          'pnpm',
+          ['install', '-g', `${packageName}@latest`, '--silent'],
+          windowsCompatibleSpawnOptions
+        );
       } else {
-        await execAsync(`npm install -g ${packageName}@latest --silent`);
+        await execFileAsync(
+          'npm',
+          ['install', '-g', `${packageName}@latest`, '--silent'],
+          windowsCompatibleSpawnOptions
+        );
       }
     } catch (err) {
       const errorMessage = err instanceof Error ? err.message : String(err);