@night-slayer18/leetcode-cli 2.0.0 → 2.0.1

package/dist/index.js

@@ -454,7 +454,7 @@ var LeetCodeClient = class {
       if (result.state === "SUCCESS" || result.state === "FAILURE") {
         return schema.parse(result);
       }
-      await new Promise((resolve) => setTimeout(resolve, delay));
+      await new Promise((resolve2) => setTimeout(resolve2, delay));
     }
     throw new Error("Submission timeout: Result not available after 30 seconds");
   }
@@ -1732,20 +1732,27 @@ function getLangSlugFromExtension(ext) {
 }
 
 // src/utils/validation.ts
+import { resolve, sep } from "path";
 function isProblemId(input) {
   return /^\d+$/.test(input);
 }
 function isFileName(input) {
   return !input.includes("/") && !input.includes("\\") && input.includes(".");
 }
+function isPathInsideWorkDir(filePath, workDir) {
+  const resolvedFilePath = resolve(filePath);
+  const resolvedWorkDir = resolve(workDir);
+  const workDirWithSep = resolvedWorkDir.endsWith(sep) ? resolvedWorkDir : resolvedWorkDir + sep;
+  return resolvedFilePath === resolvedWorkDir || resolvedFilePath.startsWith(workDirWithSep);
+}
 
 // src/commands/test.ts
 async function testCommand(fileOrId, options) {
   const { authorized } = await requireAuth();
   if (!authorized) return;
   let filePath = fileOrId;
+  const workDir = config.getWorkDir();
   if (isProblemId(fileOrId)) {
-    const workDir = config.getWorkDir();
     const found = await findSolutionFile(workDir, fileOrId);
     if (!found) {
       console.log(chalk9.red(`No solution file found for problem ${fileOrId}`));
@@ -1756,7 +1763,6 @@ async function testCommand(fileOrId, options) {
     filePath = found;
     console.log(chalk9.gray(`Found: ${filePath}`));
   } else if (isFileName(fileOrId)) {
-    const workDir = config.getWorkDir();
     const found = await findFileByName(workDir, fileOrId);
     if (!found) {
       console.log(chalk9.red(`File not found: ${fileOrId}`));
@@ -1770,6 +1776,14 @@ async function testCommand(fileOrId, options) {
     console.log(chalk9.red(`File not found: ${filePath}`));
     return;
   }
+  if (!isPathInsideWorkDir(filePath, workDir)) {
+    console.log(chalk9.red("\u26A0\uFE0F  Security Error: File path is outside the configured workspace"));
+    console.log(chalk9.gray(`File: ${filePath}`));
+    console.log(chalk9.gray(`Workspace: ${workDir}`));
+    console.log(chalk9.yellow("\nFor security reasons, you can only test files from within your workspace."));
+    console.log(chalk9.gray('Use "leetcode config workdir <path>" to change your workspace.'));
+    return;
+  }
   const spinner = ora5({ text: "Reading solution file...", spinner: "dots" }).start();
   try {
     const fileName = basename(filePath);
@@ -1902,8 +1916,8 @@ async function submitCommand(fileOrId) {
   const { authorized } = await requireAuth();
   if (!authorized) return;
   let filePath = fileOrId;
+  const workDir = config.getWorkDir();
   if (isProblemId(fileOrId)) {
-    const workDir = config.getWorkDir();
     const found = await findSolutionFile(workDir, fileOrId);
     if (!found) {
       console.log(chalk10.red(`No solution file found for problem ${fileOrId}`));
@@ -1914,7 +1928,6 @@ async function submitCommand(fileOrId) {
     filePath = found;
     console.log(chalk10.gray(`Found: ${filePath}`));
   } else if (isFileName(fileOrId)) {
-    const workDir = config.getWorkDir();
     const found = await findFileByName(workDir, fileOrId);
     if (!found) {
       console.log(chalk10.red(`File not found: ${fileOrId}`));
@@ -1928,6 +1941,14 @@ async function submitCommand(fileOrId) {
     console.log(chalk10.red(`File not found: ${filePath}`));
     return;
   }
+  if (!isPathInsideWorkDir(filePath, workDir)) {
+    console.log(chalk10.red("\u26A0\uFE0F  Security Error: File path is outside the configured workspace"));
+    console.log(chalk10.gray(`File: ${filePath}`));
+    console.log(chalk10.gray(`Workspace: ${workDir}`));
+    console.log(chalk10.yellow("\nFor security reasons, you can only submit files from within your workspace."));
+    console.log(chalk10.gray('Use "leetcode config workdir <path>" to change your workspace.'));
+    return;
+  }
   const spinner = ora6({ text: "Reading solution file...", spinner: "dots" }).start();
   try {
     const fileName = basename2(filePath);
@@ -2752,6 +2773,17 @@ import { existsSync as existsSync9 } from "fs";
 import chalk20 from "chalk";
 import inquirer3 from "inquirer";
 import ora13 from "ora";
+function sanitizeRepoName(name) {
+  return name.replace(/[^a-zA-Z0-9_-]/g, "-").replace(/--+/g, "-");
+}
+function isValidGitUrl(url) {
+  const httpsPattern = /^https:\/\/[\w.-]+\/[\w./-]+$/;
+  const sshPattern = /^git@[\w.-]+:[\w./-]+$/;
+  return httpsPattern.test(url) || sshPattern.test(url);
+}
+function escapeShellArg(arg) {
+  return `'${arg.replace(/'/g, "'\\''")}'`;
+}
 function isGitInstalled() {
   try {
     execSync("git --version", { stdio: "ignore" });
@@ -2823,7 +2855,8 @@ async function setupRemote(workDir) {
       if (createGh) {
         spinner.start("Creating GitHub repository...");
         try {
-          const repoName = workDir.split("/").pop() || "leetcode-solutions";
+          const rawRepoName = workDir.split("/").pop() || "leetcode-solutions";
+          const repoName = sanitizeRepoName(rawRepoName);
           execSync(`gh repo create ${repoName} --private --source=. --remote=origin`, { cwd: workDir });
           spinner.succeed("Created and linked GitHub repository");
           repoUrl = getRemoteUrl(workDir) || "";
@@ -2850,6 +2883,11 @@ async function setupRemote(workDir) {
       repoUrl = url;
     }
   }
+  if (repoUrl && !isValidGitUrl(repoUrl)) {
+    console.log(chalk20.red("Invalid repository URL format."));
+    console.log(chalk20.gray("Expected: https://github.com/user/repo or git@github.com:user/repo"));
+    return "";
+  }
   if (repoUrl) {
     config.setRepo(repoUrl);
   }
@@ -2891,7 +2929,7 @@ async function syncCommand() {
     const count = lines.length;
     const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace("T", " ").substring(0, 19);
     const message = `Sync: ${count} solutions - ${timestamp}`;
-    execSync(`git commit -m "${message}"`, { cwd: workDir });
+    execSync(`git commit -m ${escapeShellArg(message)}`, { cwd: workDir });
     try {
       execSync("git push -u origin main", { cwd: workDir, stdio: "ignore" });
     } catch {
@@ -3811,6 +3849,13 @@ async function diffCommand(problemId, options) {
         console.log(chalk24.red(`File not found: ${options.file}`));
         return;
       }
+      if (!isPathInsideWorkDir(options.file, workDir)) {
+        console.log(chalk24.red("\u26A0\uFE0F  Security Error: File path is outside the configured workspace"));
+        console.log(chalk24.gray(`File: ${options.file}`));
+        console.log(chalk24.gray(`Workspace: ${workDir}`));
+        console.log(chalk24.yellow("\nFor security reasons, you can only diff files from within your workspace."));
+        return;
+      }
       const otherCode = await readFile6(options.file, "utf-8");
       showComparison(currentCode, otherCode, "Your Solution", options.file, options.unified ?? false);
       return;
@@ -3953,7 +3998,7 @@ program.configureHelp({
   optionTerm: (option) => chalk26.yellow(option.flags),
   optionDescription: (option) => chalk26.white(option.description)
 });
-program.name("leetcode").usage("[command] [options]").description(chalk26.bold.cyan("\u{1F525} A modern LeetCode CLI built with TypeScript")).version("2.0.0", "-v, --version", "Output the version number").helpOption("-h, --help", "Display help for command").addHelpText("after", `
+program.name("leetcode").usage("[command] [options]").description(chalk26.bold.cyan("\u{1F525} A modern LeetCode CLI built with TypeScript")).version("2.0.1", "-v, --version", "Output the version number").helpOption("-h, --help", "Display help for command").addHelpText("after", `
 ${chalk26.yellow("Examples:")}
   ${chalk26.cyan("$ leetcode login")}             Login to LeetCode
   ${chalk26.cyan("$ leetcode list -d easy")}      List easy problems

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@night-slayer18/leetcode-cli",
-  "version": "2.0.0",
+  "version": "2.0.1",
   "description": "A modern LeetCode CLI built with TypeScript",
   "type": "module",
   "main": "dist/index.js",