@runa-ai/runa-cli 0.5.32 → 0.5.34

package/dist/index.js

@@ -925,7 +925,7 @@ var CLI_VERSION, HAS_ADMIN_COMMAND;
 var init_version = __esm({
   "src/version.ts"() {
     init_esm_shims();
-    CLI_VERSION = "0.5.32";
+    CLI_VERSION = "0.5.34";
     HAS_ADMIN_COMMAND = false;
   }
 });
@@ -3362,6 +3362,14 @@ var init_json_reporter = __esm({
 });
 
 // src/internal/vuln-checker/reporters/markdown-reporter.ts
+function escapeMarkdown(text) {
+  let escaped = text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+  escaped = escaped.replace(/\\/g, "\\\\").replace(/`/g, "\\`").replace(/\*/g, "\\*").replace(/_/g, "\\_").replace(/\{/g, "\\{").replace(/\}/g, "\\}").replace(/\[/g, "\\[").replace(/\]/g, "\\]").replace(/\(/g, "\\(").replace(/\)/g, "\\)").replace(/#/g, "\\#").replace(/\+/g, "\\+").replace(/-/g, "\\-").replace(/\./g, "\\.").replace(/!/g, "\\!").replace(/\|/g, "\\|");
+  return escaped;
+}
+function sanitizeCodeBlock(text) {
+  return text.replace(/```/g, "\\`\\`\\`");
+}
 function groupByCategory2(findings) {
   const byCategory = /* @__PURE__ */ new Map();
   for (const finding of findings) {
@@ -3392,29 +3400,31 @@ function formatMetadata(finding) {
 }
 function formatSnippet(finding) {
   if (!finding.snippet) return [];
-  return ["```", finding.snippet.text, "```\n"];
+  return ["```", sanitizeCodeBlock(finding.snippet.text), "```\n"];
 }
 function formatFix(finding) {
   if (!finding.fix) return [];
-  const lines = [`**Fix**: ${finding.fix.description}
+  const lines = [`**Fix**: ${escapeMarkdown(finding.fix.description)}
 `];
   if (finding.fix.replacement) {
-    lines.push("```", finding.fix.replacement, "```\n");
+    lines.push("```", sanitizeCodeBlock(finding.fix.replacement), "```\n");
   }
   return lines;
 }
 function formatFinding2(finding) {
   const emoji = SEVERITY_EMOJI[finding.severity];
   const location = `${formatFilePath(finding.location.file)}:${finding.location.line}`;
+  const safeTitle = escapeMarkdown(finding.title);
+  const safeDescription = escapeMarkdown(finding.description);
   return [
-    `#### ${emoji} ${finding.title}
+    `#### ${emoji} ${safeTitle}
 `,
     `- **Severity**: ${finding.severity}`,
     `- **Location**: \`${location}\``,
     `- **Rule**: \`${finding.ruleId}\``,
     ...formatMetadata(finding),
     `
-${finding.description}
+${safeDescription}
 `,
     ...formatSnippet(finding),
     ...formatFix(finding),
@@ -3483,8 +3493,9 @@ var init_markdown_reporter = __esm({
           lines.push("The following findings were ignored based on configuration:\n");
           for (const finding of result.ignoredFindings) {
             const emoji = SEVERITY_EMOJI[finding.severity];
+            const safeTitle = escapeMarkdown(finding.title);
             lines.push(
-              `- ${emoji} **${finding.title}** at \`${finding.location.file}:${finding.location.line}\``
+              `- ${emoji} **${safeTitle}** at \`${finding.location.file}:${finding.location.line}\``
             );
           }
           lines.push("");

package/dist/internal/vuln-checker/reporters/markdown-reporter.d.ts

@@ -1,5 +1,8 @@
 /**
  * Markdown reporter for human-readable vulnerability reports
+ *
+ * SECURITY (Issue #543): This reporter sanitizes all user-controlled content
+ * to prevent XSS and injection attacks when reports are rendered in web interfaces.
  */
 import type { Reporter, ScanResult } from '../types.js';
 export declare class MarkdownReporter implements Reporter {

package/dist/internal/vuln-checker/reporters/markdown-reporter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"markdown-reporter.d.ts","sourceRoot":"","sources":["../../../../src/internal/vuln-checker/reporters/markdown-reporter.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,EAAW,QAAQ,EAAE,UAAU,EAAY,MAAM,aAAa,CAAC;AAgH3E,qBAAa,gBAAiB,YAAW,QAAQ;IAC/C,IAAI,SAAc;IAElB,MAAM,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM;CAqDnC"}
+{"version":3,"file":"markdown-reporter.d.ts","sourceRoot":"","sources":["../../../../src/internal/vuln-checker/reporters/markdown-reporter.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAW,QAAQ,EAAE,UAAU,EAAY,MAAM,aAAa,CAAC;AA2K3E,qBAAa,gBAAiB,YAAW,QAAQ;IAC/C,IAAI,SAAc;IAElB,MAAM,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM;CAuDnC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runa-ai/runa-cli",
-  "version": "0.5.32",
+  "version": "0.5.34",
   "private": false,
   "description": "AI-powered DevOps CLI",
   "type": "module",
@@ -26,8 +26,6 @@
   },
   "dependencies": {
     "@dotenvx/dotenvx": "1.51.4",
-    "@runa-ai/runa": "^0.5.32",
-    "@runa-ai/runa-xstate-test-plugin": "^0.5.28",
     "@types/node": "22.19.3",
     "boxen": "7.1.1",
     "chalk": "5.6.2",
@@ -53,7 +51,9 @@
     "tsup": "8.5.1",
     "typescript": "5.9.3",
     "xstate": "5.25.0",
-    "zod": "4.3.5"
+    "zod": "4.3.5",
+    "@runa-ai/runa": "0.5.33",
+    "@runa-ai/runa-xstate-test-plugin": "0.5.28"
   },
   "engines": {
     "node": ">=20.0.0"