@runa-ai/runa-cli 0.5.33 → 0.5.35

package/dist/index.js

@@ -925,7 +925,7 @@ var CLI_VERSION, HAS_ADMIN_COMMAND;
 var init_version = __esm({
   "src/version.ts"() {
     init_esm_shims();
-    CLI_VERSION = "0.5.33";
+    CLI_VERSION = "0.5.35";
     HAS_ADMIN_COMMAND = false;
   }
 });
@@ -1722,7 +1722,8 @@ function checkBase64ForSecrets(base64String) {
     const decoded = Buffer.from(base64String, "base64").toString("utf-8");
     for (const indicator of BASE64_SECRET_INDICATORS) {
       if (decoded.startsWith(indicator)) {
-        return { found: true, decoded: `${decoded.substring(0, 20)}...` };
+        const secretType = getSecretTypeFromIndicator(indicator);
+        return { found: true, secretType };
       }
     }
     return { found: false };
@@ -1730,6 +1731,18 @@ function checkBase64ForSecrets(base64String) {
     return { found: false };
   }
 }
+function getSecretTypeFromIndicator(indicator) {
+  const indicatorMap = {
+    "sk-": "OpenAI/Stripe API key",
+    ghp_: "GitHub Personal Access Token",
+    gho_: "GitHub OAuth Token",
+    AKIA: "AWS Access Key",
+    eyJ: "JWT Token",
+    vercel_: "Vercel Token",
+    sbp_: "Supabase Token"
+  };
+  return indicatorMap[indicator] ?? "Unknown secret type";
+}
 function isCommentLine(line) {
   const trimmed = line.trim();
   return trimmed.startsWith("//") || trimmed.startsWith("#") || trimmed.startsWith("*") || trimmed.startsWith("/*") || trimmed.startsWith("<!--") || trimmed.startsWith("--");
@@ -1982,7 +1995,7 @@ function scanLineForSecrets(line, lineNumber, filePath) {
         ruleId: "secret/base64-encoded",
         severity: "high",
         title: "Base64-Encoded Secret",
-        description: `Base64-encoded secret detected. Decoded prefix: ${result.decoded}`,
+        description: `Base64-encoded secret detected. Type: ${result.secretType}`,
         location: {
           file: filePath,
           line: lineNumber,
@@ -3362,6 +3375,14 @@ var init_json_reporter = __esm({
 });
 
 // src/internal/vuln-checker/reporters/markdown-reporter.ts
+function escapeMarkdown(text) {
+  let escaped = text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+  escaped = escaped.replace(/\\/g, "\\\\").replace(/`/g, "\\`").replace(/\*/g, "\\*").replace(/_/g, "\\_").replace(/\{/g, "\\{").replace(/\}/g, "\\}").replace(/\[/g, "\\[").replace(/\]/g, "\\]").replace(/\(/g, "\\(").replace(/\)/g, "\\)").replace(/#/g, "\\#").replace(/\+/g, "\\+").replace(/-/g, "\\-").replace(/\./g, "\\.").replace(/!/g, "\\!").replace(/\|/g, "\\|");
+  return escaped;
+}
+function sanitizeCodeBlock(text) {
+  return text.replace(/```/g, "\\`\\`\\`");
+}
 function groupByCategory2(findings) {
   const byCategory = /* @__PURE__ */ new Map();
   for (const finding of findings) {
@@ -3392,29 +3413,31 @@ function formatMetadata(finding) {
 }
 function formatSnippet(finding) {
   if (!finding.snippet) return [];
-  return ["```", finding.snippet.text, "```\n"];
+  return ["```", sanitizeCodeBlock(finding.snippet.text), "```\n"];
 }
 function formatFix(finding) {
   if (!finding.fix) return [];
-  const lines = [`**Fix**: ${finding.fix.description}
+  const lines = [`**Fix**: ${escapeMarkdown(finding.fix.description)}
 `];
   if (finding.fix.replacement) {
-    lines.push("```", finding.fix.replacement, "```\n");
+    lines.push("```", sanitizeCodeBlock(finding.fix.replacement), "```\n");
   }
   return lines;
 }
 function formatFinding2(finding) {
   const emoji = SEVERITY_EMOJI[finding.severity];
   const location = `${formatFilePath(finding.location.file)}:${finding.location.line}`;
+  const safeTitle = escapeMarkdown(finding.title);
+  const safeDescription = escapeMarkdown(finding.description);
   return [
-    `#### ${emoji} ${finding.title}
+    `#### ${emoji} ${safeTitle}
 `,
     `- **Severity**: ${finding.severity}`,
     `- **Location**: \`${location}\``,
     `- **Rule**: \`${finding.ruleId}\``,
     ...formatMetadata(finding),
     `
-${finding.description}
+${safeDescription}
 `,
     ...formatSnippet(finding),
     ...formatFix(finding),
@@ -3483,8 +3506,9 @@ var init_markdown_reporter = __esm({
           lines.push("The following findings were ignored based on configuration:\n");
           for (const finding of result.ignoredFindings) {
             const emoji = SEVERITY_EMOJI[finding.severity];
+            const safeTitle = escapeMarkdown(finding.title);
             lines.push(
-              `- ${emoji} **${finding.title}** at \`${finding.location.file}:${finding.location.line}\``
+              `- ${emoji} **${safeTitle}** at \`${finding.location.file}:${finding.location.line}\``
             );
           }
           lines.push("");

package/dist/internal/vuln-checker/analyzers/secret-analyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secret-analyzer.d.ts","sourceRoot":"","sources":["../../../../src/internal/vuln-checker/analyzers/secret-analyzer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAKH,OAAO,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,QAAQ,EAAE,OAAO,EAAoB,MAAM,aAAa,CAAC;AAgiClG;;GAEG;AACH,qBAAa,cAAe,YAAW,QAAQ;IAC7C,IAAI,SAAoB;IACxB,UAAU,EAAE,QAAQ,EAAE,CAAc;IAE9B,OAAO,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;YAkB7C,cAAc;IAY5B,OAAO,CAAC,UAAU;CAGnB"}
+{"version":3,"file":"secret-analyzer.d.ts","sourceRoot":"","sources":["../../../../src/internal/vuln-checker/analyzers/secret-analyzer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAKH,OAAO,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,QAAQ,EAAE,OAAO,EAAoB,MAAM,aAAa,CAAC;AA2jClG;;GAEG;AACH,qBAAa,cAAe,YAAW,QAAQ;IAC7C,IAAI,SAAoB;IACxB,UAAU,EAAE,QAAQ,EAAE,CAAc;IAE9B,OAAO,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;YAkB7C,cAAc;IAY5B,OAAO,CAAC,UAAU;CAGnB"}

package/dist/internal/vuln-checker/reporters/markdown-reporter.d.ts

@@ -1,5 +1,8 @@
 /**
  * Markdown reporter for human-readable vulnerability reports
+ *
+ * SECURITY (Issue #543): This reporter sanitizes all user-controlled content
+ * to prevent XSS and injection attacks when reports are rendered in web interfaces.
  */
 import type { Reporter, ScanResult } from '../types.js';
 export declare class MarkdownReporter implements Reporter {

package/dist/internal/vuln-checker/reporters/markdown-reporter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"markdown-reporter.d.ts","sourceRoot":"","sources":["../../../../src/internal/vuln-checker/reporters/markdown-reporter.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,EAAW,QAAQ,EAAE,UAAU,EAAY,MAAM,aAAa,CAAC;AAgH3E,qBAAa,gBAAiB,YAAW,QAAQ;IAC/C,IAAI,SAAc;IAElB,MAAM,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM;CAqDnC"}
+{"version":3,"file":"markdown-reporter.d.ts","sourceRoot":"","sources":["../../../../src/internal/vuln-checker/reporters/markdown-reporter.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAW,QAAQ,EAAE,UAAU,EAAY,MAAM,aAAa,CAAC;AA2K3E,qBAAa,gBAAiB,YAAW,QAAQ;IAC/C,IAAI,SAAc;IAElB,MAAM,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM;CAuDnC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runa-ai/runa-cli",
-  "version": "0.5.33",
+  "version": "0.5.35",
   "private": false,
   "description": "AI-powered DevOps CLI",
   "type": "module",
@@ -53,7 +53,7 @@
     "xstate": "5.25.0",
     "zod": "4.3.5",
     "@runa-ai/runa": "0.5.33",
-    "@runa-ai/runa-xstate-test-plugin": "0.5.28"
+    "@runa-ai/runa-xstate-test-plugin": "0.5.35"
   },
   "engines": {
     "node": ">=20.0.0"