@natjswenson/shipflow 0.2.3 → 0.2.4

package/bin/shipflow.js

@@ -14,6 +14,7 @@ import {
   dispatchReleaseWorkflow,
   renameDefaultBranch,
 } from '../lib/apply.mjs';
+import { readFileCapped } from '../lib/gh.mjs';
 
 const PACKAGE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
 const TEMPLATE_PATH = join(PACKAGE_ROOT, 'templates', 'dev-to-main-automerge.yml.tmpl');
@@ -24,7 +25,10 @@ function readPackageVersion() {
 }
 
 function readConfig(path) {
-  return JSON.parse(readFileSync(path, 'utf8'));
+  // .github/shipflow.json lives in whatever repo --repo points at — a
+  // repo-write-editable file, not admin-only — so cap its size before
+  // parsing (see lib/gh.mjs's readFileCapped for why).
+  return JSON.parse(readFileCapped(path));
 }
 
 function defaultConfigPath(repoPath) {

package/lib/detect.mjs

@@ -1,6 +1,6 @@
-import { existsSync, readFileSync } from 'node:fs';
+import { existsSync } from 'node:fs';
 import { join } from 'node:path';
-import { spawnArgs, ghApiJson, git, sha256 } from './gh.mjs';
+import { spawnArgs, ghApiJson, git, sha256, readFileCapped } from './gh.mjs';
 
 const TEMPLATE_RELATIVE_PATH = '.github/workflows/dev-to-main-automerge.yml';
 const CONFIG_RELATIVE_PATH = '.github/shipflow.json';
@@ -14,11 +14,20 @@ const SETTINGS_AS_CODE_NAME_RE = /repo-settings\.(sh|js|mjs|py)$/i;
 const SETTINGS_AS_CODE_CONTENT_RE =
   /github_branch_protection|github_repository_ruleset|branches\/[\w-]+\/protection/;
 
+// A segment made of only dots ("." / ".." / "...") matches [\w.-]+ but is
+// never a real GitHub owner or repo name — reject it rather than build an
+// ownerRepo string that could normalize away the intended repos/<owner>/<repo>
+// prefix once interpolated into gh api paths downstream.
+const ALL_DOTS_RE = /^\.+$/;
+
 export function resolveOwnerRepo(repoPath) {
   const r = git(['remote', 'get-url', 'origin'], { cwd: repoPath });
   if (r.status !== 0) return null;
   const m = r.stdout.match(/github\.com[:/]([\w.-]+)\/([\w.-]+?)(\.git)?$/);
-  return m ? `${m[1]}/${m[2]}` : null;
+  if (!m) return null;
+  const [, owner, repo] = m;
+  if (ALL_DOTS_RE.test(owner) || ALL_DOTS_RE.test(repo)) return null;
+  return `${owner}/${repo}`;
 }
 
 export function listTrackedFiles(repoPath) {
@@ -42,7 +51,7 @@ export function findSettingsAsCodeArtifact(repoPath, trackedFiles) {
     if (!existsSync(full)) continue;
     let content;
     try {
-      content = readFileSync(full, 'utf8');
+      content = readFileCapped(full);
     } catch {
       continue;
     }
@@ -66,7 +75,7 @@ export function listWorkflowJobNames(repoPath, trackedFiles) {
     if (!existsSync(full)) continue;
     let content;
     try {
-      content = readFileSync(full, 'utf8');
+      content = readFileCapped(full);
     } catch {
       continue;
     }
@@ -87,7 +96,7 @@ export function listWorkflowJobNames(repoPath, trackedFiles) {
 export function readTemplateFileHash(repoPath) {
   const full = join(repoPath, TEMPLATE_RELATIVE_PATH);
   if (!existsSync(full)) return { exists: false, sha256: null };
-  const content = readFileSync(full, 'utf8');
+  const content = readFileCapped(full);
   return { exists: true, sha256: sha256(content) };
 }
 
@@ -95,14 +104,14 @@ export function readExistingConfig(repoPath) {
   const full = join(repoPath, CONFIG_RELATIVE_PATH);
   if (!existsSync(full)) return null;
   try {
-    return JSON.parse(readFileSync(full, 'utf8'));
+    return JSON.parse(readFileCapped(full));
   } catch {
     return null;
   }
 }
 
 export function fetchBranchProtection(ownerRepo, branch) {
-  const r = ghApiJson(`repos/${ownerRepo}/branches/${branch}/protection`);
+  const r = ghApiJson(`repos/${ownerRepo}/branches/${encodeURIComponent(branch)}/protection`);
   if (!r.ok) return null;
   const checks = r.data?.required_status_checks?.contexts ?? [];
   return { requiredChecks: checks, raw: r.data };
@@ -133,7 +142,7 @@ export function fetchRulesetRequiredChecks(ownerRepo, rulesetId) {
 }
 
 export function checkSecretPresent(ownerRepo, secretName) {
-  const r = ghApiJson(`repos/${ownerRepo}/actions/secrets/${secretName}`);
+  const r = ghApiJson(`repos/${ownerRepo}/actions/secrets/${encodeURIComponent(secretName)}`);
   return r.ok;
 }
 

package/lib/gh.mjs

@@ -1,6 +1,23 @@
 import { spawnSync } from 'node:child_process';
+import { statSync, readFileSync } from 'node:fs';
 import { createHash } from 'node:crypto';
 
+// Every file shipflow reads under a target repo (.github/shipflow.json,
+// candidate settings-as-code artifacts, workflow YAML, the rendered
+// template on disk) is repo-write-controlled, not admin-only — a
+// maliciously huge or pathologically nested file could exhaust memory on
+// an unbounded readFileSync/JSON.parse. 1 MB is generous for any
+// legitimate config/workflow/IaC file shipflow actually needs to read.
+const MAX_READ_BYTES = 1_000_000;
+
+export function readFileCapped(path, encoding = 'utf8') {
+  const size = statSync(path).size;
+  if (size > MAX_READ_BYTES) {
+    throw new Error(`refusing to read ${path}: ${size} bytes exceeds the ${MAX_READ_BYTES}-byte safety cap`);
+  }
+  return readFileSync(path, encoding);
+}
+
 // argv-style invocation; no shell, so user-supplied args cannot inject.
 // Returns { status, stdout, stderr } so callers can distinguish failure modes
 // (e.g. a 404 from gh vs. a network error) instead of collapsing to a boolean.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@natjswenson/shipflow",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "description": "Scaffold a configurable dev/main branching, auto-merge, branch-cleanup, and release-tagging workflow into any repo",
   "license": "MIT",
   "author": "Nate Swenson",