@salesforce/cli 2.158.7 → 2.159.0

package/README.md

@@ -25,7 +25,7 @@ $ npm install -g @salesforce/cli
 $ sf COMMAND
 running command...
 $ sf (--version|-v)
-@salesforce/cli/2.158.7 linux-x64 node-v26.13.0
+@salesforce/cli/2.159.0 linux-x64 node-v26.13.0
 $ sf --help [COMMAND]
 USAGE
   $ sf COMMAND

package/node_modules/basic-ftp/dist/Client.js

@@ -11,6 +11,7 @@ const parseControlResponse_1 = require("./parseControlResponse");
 const parseList_1 = require("./parseList");
 const parseListMLSD_1 = require("./parseListMLSD");
 const ProgressTracker_1 = require("./ProgressTracker");
+const safePathNames_1 = require("./safePathNames");
 const StringWriter_1 = require("./StringWriter");
 const transfer_1 = require("./transfer");
 // Use promisify to keep the library compatible with Node 8.
@@ -647,8 +648,7 @@ class Client {
     async _downloadFromWorkingDir(localDirPath) {
         await ensureLocalDirectory(localDirPath);
         for (const file of await this.list()) {
-            const hasInvalidName = !file.name || (0, path_1.basename)(file.name) !== file.name;
-            if (hasInvalidName) {
+            if (!(0, safePathNames_1.isSafePathName)(file.name)) {
                 const safeName = JSON.stringify(file.name);
                 this.ftp.log(`Invalid filename from server listing, will skip file. (${safeName})`);
                 continue;

package/node_modules/basic-ftp/dist/safePathNames.d.ts

@@ -0,0 +1,6 @@
+import * as path from "path";
+/**
+ * Returns true if a name from a directory listing can only refer to an entry directly inside a
+ * local directory when joined with its path.
+ */
+export declare function isSafePathName(name: string, localPath?: typeof path): boolean;

package/node_modules/basic-ftp/dist/safePathNames.js

@@ -0,0 +1,52 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isSafePathName = isSafePathName;
+const path = __importStar(require("path"));
+/**
+ * Returns true if a name from a directory listing can only refer to an entry directly inside a
+ * local directory when joined with its path.
+ */
+function isSafePathName(name, localPath = path) {
+    if (!name || name === "." || name === ".." || name.includes("/")) {
+        return false;
+    }
+    if (localPath.sep === "\\") {
+        // Windows also separates with "\", reads ":" as a drive (older Node joins "." and "C:" to
+        // "C:", see CVE-2025-23084) and ignores trailing dots and spaces, so ".. " acts like "..".
+        return !/[\\:]/.test(name) && !/^[. ]+$/.test(name);
+    }
+    return true;
+}

package/node_modules/basic-ftp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "basic-ftp",
-  "version": "6.2.5",
+  "version": "6.2.6",
   "description": "FTP client for Node.js, supports FTPS over TLS, IPv6, Async/Await, and Typescript.",
   "main": "dist/index",
   "types": "dist/index",

package/oclif.manifest.json

@@ -7024,5 +7024,5 @@
       "requiresProject": true
     }
   },
-  "version": "2.158.7"
+  "version": "2.159.0"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@salesforce/cli",
   "description": "The Salesforce CLI",
-  "version": "2.158.7",
+  "version": "2.159.0",
   "author": "Salesforce",
   "bin": {
     "sf": "./bin/run.js",
@@ -251,7 +251,7 @@
     "@opentelemetry/core": "3.0.0",
     "@opentelemetry/resources": "3.0.0",
     "@opentelemetry/semantic-conventions": "1.44.0",
-    "basic-ftp": "6.2.5"
+    "basic-ftp": "6.2.6"
   },
   "repository": "salesforcecli/cli",
   "scripts": {