@redocly/cli 1.25.14 → 1.26.0

package/src/commands/translations.ts

@@ -1,4 +1,5 @@
 import { spawn } from 'child_process';
+import { getPlatformSpawnArgs, sanitizeLocale, sanitizePath } from '../utils/platform';
 
 import type { CommandArgs } from '../wrapper';
 import type { VerifyConfigOptions } from '../types';
@@ -10,10 +11,22 @@ export type TranslationsOptions = {
 
 export const handleTranslations = async ({ argv }: CommandArgs<TranslationsOptions>) => {
   process.stdout.write(`\nLaunching translate using NPX.\n\n`);
-  const npxExecutableName = process.platform === 'win32' ? 'npx.cmd' : 'npx';
-  spawn(
+  const { npxExecutableName, sanitize, shell } = getPlatformSpawnArgs();
+
+  const projectDir = sanitize(argv['project-dir'], sanitizePath);
+  const locale = sanitize(argv.locale, sanitizeLocale);
+
+  const child = spawn(
     npxExecutableName,
-    ['-y', '@redocly/realm', 'translate', argv.locale, `-d=${argv['project-dir']}`],
-    { stdio: 'inherit' }
+    ['-y', '@redocly/realm', 'translate', locale, `-d=${projectDir}`],
+    {
+      stdio: 'inherit',
+      shell,
+    }
   );
+
+  child.on('error', (error) => {
+    process.stderr.write(`Translate launch failed: ${error.message}`);
+    throw new Error(`Translate launch failed.`);
+  });
 };

package/src/index.ts

@@ -473,86 +473,94 @@ yargs
     'bundle [apis...]',
     'Bundle a multi-file API description to a single file.',
     (yargs) =>
-      yargs.positional('apis', { array: true, type: 'string', demandOption: true }).options({
-        output: {
-          type: 'string',
-          description: 'Output file.',
-          alias: 'o',
-        },
-        ext: {
-          description: 'Bundle file extension.',
-          requiresArg: true,
-          choices: outputExtensions,
-        },
-        'skip-preprocessor': {
-          description: 'Ignore certain preprocessors.',
-          array: true,
-          type: 'string',
-        },
-        'skip-decorator': {
-          description: 'Ignore certain decorators.',
-          array: true,
-          type: 'string',
-        },
-        dereferenced: {
-          alias: 'd',
-          type: 'boolean',
-          description: 'Produce a fully dereferenced bundle.',
-        },
-        force: {
-          alias: 'f',
-          type: 'boolean',
-          description: 'Produce bundle output even when errors occur.',
-        },
-        config: {
-          description: 'Path to the config file.',
-          type: 'string',
-        },
-        metafile: {
-          description: 'Produce metadata about the bundle',
-          type: 'string',
-        },
-        extends: {
-          description: 'Override extends configurations (defaults or config file settings).',
-          requiresArg: true,
-          array: true,
-          type: 'string',
-          hidden: true,
-        },
-        'remove-unused-components': {
-          description: 'Remove unused components.',
-          type: 'boolean',
-          default: false,
-        },
-        'keep-url-references': {
-          description: 'Keep absolute url references.',
-          type: 'boolean',
-          alias: 'k',
-        },
-        'lint-config': {
-          description: 'Severity level for config file linting.',
-          choices: ['warn', 'error', 'off'] as ReadonlyArray<RuleSeverity>,
-          default: 'warn' as RuleSeverity,
-        },
-        format: {
-          hidden: true,
-          deprecated: true,
-        },
-        lint: {
-          hidden: true,
-          deprecated: true,
-        },
-        'skip-rule': {
-          hidden: true,
-          deprecated: true,
-          array: true,
-          type: 'string',
-        },
-        'max-problems': {
-          hidden: true,
-          deprecated: true,
-        },
-      }),
+      yargs
+        .positional('apis', { array: true, type: 'string', demandOption: true })
+        .options({
+          output: {
+            type: 'string',
+            description: 'Output file or folder for inline APIs.',
+            alias: 'o',
+          },
+          ext: {
+            description: 'Bundle file extension.',
+            requiresArg: true,
+            choices: outputExtensions,
+          },
+          'skip-preprocessor': {
+            description: 'Ignore certain preprocessors.',
+            array: true,
+            type: 'string',
+          },
+          'skip-decorator': {
+            description: 'Ignore certain decorators.',
+            array: true,
+            type: 'string',
+          },
+          dereferenced: {
+            alias: 'd',
+            type: 'boolean',
+            description: 'Produce a fully dereferenced bundle.',
+          },
+          force: {
+            alias: 'f',
+            type: 'boolean',
+            description: 'Produce bundle output even when errors occur.',
+          },
+          config: {
+            description: 'Path to the config file.',
+            type: 'string',
+          },
+          metafile: {
+            description: 'Produce metadata about the bundle',
+            type: 'string',
+          },
+          extends: {
+            description: 'Override extends configurations (defaults or config file settings).',
+            requiresArg: true,
+            array: true,
+            type: 'string',
+            hidden: true,
+          },
+          'remove-unused-components': {
+            description: 'Remove unused components.',
+            type: 'boolean',
+            default: false,
+          },
+          'keep-url-references': {
+            description: 'Keep absolute url references.',
+            type: 'boolean',
+            alias: 'k',
+          },
+          'lint-config': {
+            description: 'Severity level for config file linting.',
+            choices: ['warn', 'error', 'off'] as ReadonlyArray<RuleSeverity>,
+            default: 'warn' as RuleSeverity,
+          },
+          format: {
+            hidden: true,
+            deprecated: true,
+          },
+          lint: {
+            hidden: true,
+            deprecated: true,
+          },
+          'skip-rule': {
+            hidden: true,
+            deprecated: true,
+            array: true,
+            type: 'string',
+          },
+          'max-problems': {
+            hidden: true,
+            deprecated: true,
+          },
+        })
+        .check((argv) => {
+          if (argv.output && (!argv.apis || argv.apis.length === 0)) {
+            throw new Error('At least one inline API must be specified when using --output.');
+          }
+          return true;
+        }),
     (argv) => {
       const DEPRECATED_OPTIONS = ['lint', 'format', 'skip-rule', 'max-problems'];
       const LINT_AND_BUNDLE_DOCUMENTATION_LINK =
@@ -778,7 +786,7 @@ yargs
         })
         .check((argv: any) => {
           if (argv.theme && !argv.theme?.openapi)
-            throw Error('Invalid option: theme.openapi not set');
+            throw Error('Invalid option: theme.openapi not set.');
           return true;
         }),
     async (argv) => {

package/src/utils/miscellaneous.ts

@@ -529,7 +529,7 @@ export function checkIfRulesetExist(rules: typeof StyleguideConfig.prototype.rul
     ...rules.oas3_1,
     ...rules.async2,
     ...rules.async3,
-    ...rules.arazzo,
+    ...rules.arazzo1,
   };
 
   if (isEmptyObject(ruleset)) {

package/src/utils/platform.ts

@@ -0,0 +1,31 @@
+/**
+ * Sanitizes the input path by removing invalid characters.
+ */
+export const sanitizePath = (input: string): string => {
+  return input.replace(/[^a-zA-Z0-9 ._\-:\\/@]/g, '');
+};
+
+/**
+ * Sanitizes the input locale (ex. en-US) by removing invalid characters.
+ */
+export const sanitizeLocale = (input: string): string => {
+  return input.replace(/[^a-zA-Z0-9@._-]/g, '');
+};
+
+/**
+ * Retrieves platform-specific arguments and utilities.
+ */
+export function getPlatformSpawnArgs() {
+  const isWindowsPlatform = process.platform === 'win32';
+  const npxExecutableName = isWindowsPlatform ? 'npx.cmd' : 'npx';
+
+  const sanitizeIfWindows = (input: string | undefined, sanitizer: (input: string) => string) => {
+    if (isWindowsPlatform && input) {
+      return sanitizer(input);
+    } else {
+      return input || '';
+    }
+  };
+
+  return { npxExecutableName, sanitize: sanitizeIfWindows, shell: isWindowsPlatform };
+}