@orth/cli 0.2.18 → 0.2.20

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/dist/api.js +1 -1
  2. package/dist/commands/auth.js +28 -7
  3. package/package.json +1 -1
package/dist/api.js CHANGED
@@ -8,7 +8,7 @@ exports.getDetails = getDetails;
8
8
  exports.run = run;
9
9
  exports.integrate = integrate;
10
10
  const config_js_1 = require("./config.js");
11
- const BASE_URL = "https://api.orth.sh/v1";
11
+ const BASE_URL = process.env.ORTH_API_URL || "https://api.orth.sh/v1";
12
12
  async function apiRequest(endpoint, options = {}) {
13
13
  const apiKey = (0, config_js_1.requireApiKey)();
14
14
  const res = await fetch(`${BASE_URL}${endpoint}`, {
package/dist/commands/auth.js CHANGED
@@ -10,22 +10,31 @@ const chalk_1 = __importDefault(require("chalk"));
10
10
  const crypto_1 = __importDefault(require("crypto"));
11
11
  const http_1 = __importDefault(require("http"));
12
12
  const config_js_1 = require("../config.js");
13
- const API_BASE = process.env.ORTH_API_URL || "https://api.orth.sh";
14
13
  const WEB_BASE = process.env.ORTH_WEB_URL || "https://orthogonal.sh";
14
+ function escapeHtml(str) {
15
+ return str
16
+ .replace(/&/g, "&")
17
+ .replace(/</g, "&lt;")
18
+ .replace(/>/g, "&gt;")
19
+ .replace(/"/g, "&quot;")
20
+ .replace(/'/g, "&#39;");
21
+ }
15
22
  function openBrowser(url) {
16
- const { exec } = require("child_process");
23
+ // Use execFile-style args to avoid shell injection
24
+ const { execFile } = require("child_process");
17
25
  const platform = process.platform;
18
26
  if (platform === "darwin")
19
- exec(`open "${url}"`);
27
+ execFile("open", [url]);
20
28
  else if (platform === "win32")
21
- exec(`start "${url}"`);
29
+ execFile("cmd", ["/c", "start", "", url]);
22
30
  else
23
- exec(`xdg-open "${url}"`);
31
+ execFile("xdg-open", [url]);
24
32
  }
25
33
  async function browserLogin() {
26
34
  // Generate a random state token to prevent CSRF
27
35
  const state = crypto_1.default.randomBytes(32).toString("hex");
28
36
  return new Promise((resolve, reject) => {
37
+ let timeoutHandle;
29
38
  const server = http_1.default.createServer((req, res) => {
30
39
  const url = new URL(req.url || "/", `http://localhost`);
31
40
  if (url.pathname === "/callback") {
@@ -34,6 +43,7 @@ async function browserLogin() {
34
43
  const returnedState = url.searchParams.get("state");
35
44
  // Verify state token
36
45
  if (returnedState !== state) {
46
+ clearTimeout(timeoutHandle);
37
47
  res.writeHead(403, { "Content-Type": "text/html" });
38
48
  res.end(`
39
49
  <html>
@@ -51,6 +61,7 @@ async function browserLogin() {
51
61
  return;
52
62
  }
53
63
  if (key) {
64
+ clearTimeout(timeoutHandle);
54
65
  // Send a nice HTML response
55
66
  res.writeHead(200, { "Content-Type": "text/html" });
56
67
  res.end(`
@@ -63,6 +74,13 @@ async function browserLogin() {
63
74
  </body>
64
75
  </html>
65
76
  `);
77
+ if (!key.startsWith("orth_")) {
78
+ console.log(chalk_1.default.red("\n✗ Invalid API key format received"));
79
+ server.close();
80
+ clearTimeout(timeoutHandle);
81
+ reject(new Error("Invalid key format"));
82
+ return;
83
+ }
66
84
  (0, config_js_1.setApiKey)(key);
67
85
  console.log(chalk_1.default.green("\n✓ Logged in successfully!"));
68
86
  console.log(chalk_1.default.gray(` Key: ${key.slice(0, 15)}...${key.slice(-4)}`));
@@ -70,13 +88,15 @@ async function browserLogin() {
70
88
  resolve();
71
89
  }
72
90
  else {
91
+ clearTimeout(timeoutHandle);
92
+ const safeError = escapeHtml(error || "Unknown error");
73
93
  res.writeHead(400, { "Content-Type": "text/html" });
74
94
  res.end(`
75
95
  <html>
76
96
  <body style="font-family: -apple-system, sans-serif; display: flex; align-items: center; justify-content: center; height: 100vh; margin: 0; background: #f0f0f0;">
77
97
  <div style="text-align: center; background: white; padding: 48px; border-radius: 16px; box-shadow: 0 4px 12px rgba(0,0,0,0.1);">
78
98
  <h1 style="font-size: 24px; margin: 0 0 8px; color: #e11d48;">Authentication Failed</h1>
79
- <p style="color: #666; margin: 0;">${error || "Unknown error"}</p>
99
+ <p style="color: #666; margin: 0;">${safeError}</p>
80
100
  </div>
81
101
  </body>
82
102
  </html>
@@ -104,13 +124,14 @@ async function browserLogin() {
104
124
  console.log(chalk_1.default.gray(`If it doesn't open, visit: ${authUrl}\n`));
105
125
  openBrowser(authUrl);
106
126
  // Timeout after 5 minutes
107
- setTimeout(() => {
127
+ timeoutHandle = setTimeout(() => {
108
128
  console.log(chalk_1.default.red("\n✗ Login timed out. Try again."));
109
129
  server.close();
110
130
  reject(new Error("Timed out"));
111
131
  }, 5 * 60 * 1000);
112
132
  });
113
133
  server.on("error", (err) => {
134
+ clearTimeout(timeoutHandle);
114
135
  reject(err);
115
136
  });
116
137
  });
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@orth/cli",
3
- "version": "0.2.18",
3
+ "version": "0.2.20",
4
4
  "description": "CLI to access all APIs and skills on the Orthogonal platform",
5
5
  "main": "dist/index.js",
6
6
  "bin": {