@sasjs/cli 5.0.2 → 5.1.0

package/build/commands/docs/generateDocs.js

@@ -94,7 +94,7 @@ var shell_1 = require("../../utils/shell");
  */
 function generateDocs(target, config, outDirectory) {
     return __awaiter(this, void 0, void 0, function () {
-        var _a, serverUrl, newOutDirectory, enableLineage, doxyContentFromConfig, _b, macroCoreFolders, macroFolders, programFolders, serviceFolders, jobFolders, combinedFolders, PROJECT_NAME, PROJECT_BRIEF, packageJsonContent, packageJson, e_1, doxyContent, layoutFilePath, LAYOUT_FILE, readMePath, doxyParams, doxyConfigPath, spinner, pathExists, _c, stderr, code, foldersListForDot;
+        var _a, serverUrl, newOutDirectory, enableLineage, doxyContentFromConfig, _b, macroCoreFolders, macroFolders, programFolders, serviceFolders, jobFolders, combinedFolders, PROJECT_NAME, PROJECT_BRIEF, packageJsonContent, packageJson, e_1, doxyContent, layoutFilePath, LAYOUT_FILE, readMePath, doxyVariables, doxyConfigPath, spinner, pathExists, _c, stderr, code, foldersListForDot;
         var _this = this;
         var _d, _e;
         return __generator(this, function (_f) {
@@ -163,7 +163,7 @@ function generateDocs(target, config, outDirectory) {
                 case 5:
                     LAYOUT_FILE = _f.sent();
                     readMePath = path_1.default.join(doxyContent.path, doxyContent.readMe);
-                    doxyParams = setVariableCmd({
+                    doxyVariables = {
                         DOXY_HTML_OUTPUT: newOutDirectory,
                         DOXY_INPUT: "\"".concat(readMePath, "\" ").concat(combinedFolders),
                         DOXY_MAINPAGE: readMePath,
@@ -175,7 +175,7 @@ function generateDocs(target, config, outDirectory) {
                         PROJECT_BRIEF: PROJECT_BRIEF,
                         PROJECT_LOGO: path_1.default.join(doxyContent.path, doxyContent.logo),
                         PROJECT_NAME: PROJECT_NAME
-                    });
+                    };
                     return [4 /*yield*/, getDoxyConfigPath(doxyContent.path)];
                 case 6:
                     doxyConfigPath = _f.sent();
@@ -194,8 +194,9 @@ function generateDocs(target, config, outDirectory) {
                 case 9: return [4 /*yield*/, (0, utils_1.createFolder)(newOutDirectory)];
                 case 10:
                     _f.sent();
-                    _c = (0, shell_1.exec)("".concat(doxyParams, " doxygen \"").concat(doxyConfigPath, "\""), {
-                        silent: process.env.LOG_LEVEL !== utils_1.LogLevel.Debug
+                    _c = (0, shell_1.execFile)('doxygen', [doxyConfigPath], {
+                        silent: process.env.LOG_LEVEL !== utils_1.LogLevel.Debug,
+                        env: doxyVariables
                     }), stderr = _c.stderr, code = _c.code;
                     if (process.env.LOG_LEVEL !== utils_1.LogLevel.Debug)
                         spinner.stop();
@@ -228,18 +229,6 @@ function generateDocs(target, config, outDirectory) {
         });
     });
 }
-function setVariableCmd(params) {
-    var command = '';
-    if ((0, utils_1.isWindows)()) {
-        for (var param in params)
-            command += "set ".concat(param, "=").concat(params[param], " && ");
-    }
-    else {
-        for (var param in params)
-            command += "".concat(param, "='").concat(params[param], "' ");
-    }
-    return command;
-}
 var getDoxyConfigPath = function (doxyContentPath) { return __awaiter(void 0, void 0, void 0, function () {
     var doxyFilePath;
     return __generator(this, function (_a) {

package/build/commands/docs/spec/generateDocs.spec.js

@@ -555,7 +555,7 @@ describe('sasjs doc', function () {
         return __generator(this, function (_a) {
             switch (_a.label) {
                 case 0:
-                    jest.spyOn(shell, 'exec').mockReturnValueOnce({
+                    jest.spyOn(shell, 'execFile').mockReturnValueOnce({
                         code: 1,
                         stderr: 'error: bad config',
                         stdout: ''
@@ -571,7 +571,7 @@ describe('sasjs doc', function () {
         return __generator(this, function (_a) {
             switch (_a.label) {
                 case 0:
-                    jest.spyOn(shell, 'exec').mockReturnValueOnce({
+                    jest.spyOn(shell, 'execFile').mockReturnValueOnce({
                         code: 1,
                         stderr: 'command not found',
                         stdout: ''

package/build/commands/shared/createLintConfigFile.js

@@ -41,7 +41,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createLintConfigFile = void 0;
 var path_1 = __importDefault(require("path"));
-var getLintConfig_1 = require("@sasjs/lint/utils/getLintConfig");
+var lint_1 = require("@sasjs/lint");
 var utils_1 = require("@sasjs/utils");
 /**
  * Creates a SASjs Lint configuration file.
@@ -54,7 +54,7 @@ var createLintConfigFile = function (parentFolderName) { return __awaiter(void 0
         switch (_a.label) {
             case 0:
                 configDestinationPath = path_1.default.join(process.projectDir, parentFolderName, '.sasjslint');
-                return [4 /*yield*/, (0, utils_1.createFile)(configDestinationPath, JSON.stringify(getLintConfig_1.DefaultLintConfiguration, null, 2))];
+                return [4 /*yield*/, (0, utils_1.createFile)(configDestinationPath, JSON.stringify(lint_1.DefaultLintConfiguration, null, 2))];
             case 1:
                 _a.sent();
                 return [2 /*return*/];

package/build/utils/shell.d.ts

@@ -17,15 +17,27 @@ export interface ShellResult {
     stderr: string;
     code: number;
 }
+export interface ExecOptions {
+    /**
+     * Whether the command's output also reaches this process's streams, which is
+     * how shelljs' option of the same name behaved.
+     */
+    silent?: boolean;
+    /** Extra variables for the child, on top of this process's environment. */
+    env?: NodeJS.ProcessEnv;
+}
+/** Runs a command through the platform shell. */
+export declare const exec: (command: string, options?: ExecOptions) => ShellResult;
 /**
- * Runs a command through the platform shell.
+ * Runs an executable with an argument array, without a shell.
  *
- * `silent` decides whether the command's output also reaches this process's
- * streams, which is how shelljs' option of the same name behaved.
+ * `exec` hands its command to a shell, which re-parses everything in it: a path
+ * containing a quote, `$` or `&` changes the command's meaning, and a variable
+ * assigned on the command line is no different - on Windows the assignment form
+ * does not even quote the value. Arguments and `env` given here are passed to
+ * the child as they are, so they are safe whatever they contain.
  */
-export declare const exec: (command: string, options?: {
-    silent?: boolean;
-}) => ShellResult;
+export declare const execFile: (command: string, args: string[], options?: ExecOptions) => ShellResult;
 /**
  * Copies the contents of a folder into another folder, matching
  * `cp -r <source>/. <destination>`.

package/build/utils/shell.js

@@ -1,4 +1,15 @@
 "use strict";
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
+};
 var __values = (this && this.__values) || function(o) {
     var s = typeof Symbol === "function" && Symbol.iterator, m = s && o[s], i = 0;
     if (m) return m.call(o);
@@ -14,28 +25,25 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.which = exports.ls = exports.rm = exports.cp = exports.exec = void 0;
+exports.which = exports.ls = exports.rm = exports.cp = exports.execFile = exports.exec = void 0;
 var child_process_1 = require("child_process");
 var fs_1 = __importDefault(require("fs"));
 var path_1 = __importDefault(require("path"));
 var utils_1 = require("@sasjs/utils");
 /**
- * Runs a command through the platform shell.
- *
- * `silent` decides whether the command's output also reaches this process's
- * streams, which is how shelljs' option of the same name behaved.
+ * The options both runners share. shelljs allowed 20MB of output; spawnSync's
+ * 1MB default kills a chatty command mid-run, and a deploy script can easily be
+ * chatty.
  */
-var exec = function (command, options) {
+var spawnOptions = function (options) { return ({
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'pipe'],
+    maxBuffer: 20 * 1024 * 1024,
+    env: options.env ? __assign(__assign({}, process.env), options.env) : undefined
+}); };
+/** The result both runners answer with, from one place. */
+var toShellResult = function (result, options) {
     var _a, _b, _c;
-    if (options === void 0) { options = {}; }
-    var result = (0, child_process_1.spawnSync)(command, {
-        shell: true,
-        encoding: 'utf8',
-        stdio: ['ignore', 'pipe', 'pipe'],
-        // shelljs allowed 20MB of output; spawnSync's 1MB default kills a chatty
-        // command mid-run, and a deploy script can easily be chatty.
-        maxBuffer: 20 * 1024 * 1024
-    });
     var stdout = (_a = result.stdout) !== null && _a !== void 0 ? _a : '';
     var stderr = (_b = result.stderr) !== null && _b !== void 0 ? _b : '';
     if (!options.silent) {
@@ -56,7 +64,26 @@ var exec = function (command, options) {
     }
     return { stdout: stdout, stderr: stderr, code: (_c = result.status) !== null && _c !== void 0 ? _c : 0 };
 };
+/** Runs a command through the platform shell. */
+var exec = function (command, options) {
+    if (options === void 0) { options = {}; }
+    return toShellResult((0, child_process_1.spawnSync)(command, __assign(__assign({}, spawnOptions(options)), { shell: true })), options);
+};
 exports.exec = exec;
+/**
+ * Runs an executable with an argument array, without a shell.
+ *
+ * `exec` hands its command to a shell, which re-parses everything in it: a path
+ * containing a quote, `$` or `&` changes the command's meaning, and a variable
+ * assigned on the command line is no different - on Windows the assignment form
+ * does not even quote the value. Arguments and `env` given here are passed to
+ * the child as they are, so they are safe whatever they contain.
+ */
+var execFile = function (command, args, options) {
+    if (options === void 0) { options = {}; }
+    return toShellResult((0, child_process_1.spawnSync)(command, args, spawnOptions(options)), options);
+};
+exports.execFile = execFile;
 /**
  * Copies the contents of a folder into another folder, matching
  * `cp -r <source>/. <destination>`.

package/build/utils/spec/shell.spec.js

@@ -54,6 +54,33 @@ describe('shell', function () {
             expect(result.stdout.length).toEqual(3 * 1024 * 1024);
         });
     });
+    describe('execFile', function () {
+        // The values below are the point: a shell would interpret each of them -
+        // `&` and `;` separate commands, `$(...)` and backticks substitute, `'`
+        // closes a quote - and on Windows the `set NAME=value` form does not quote
+        // the value at all. Nothing here is parsed, so each arrives intact.
+        var metacharacters = "a'b&c;$(echo pwned)`id`|d>e";
+        it('should answer with stdout for an executable run with an argument array', function () {
+            var result = (0, shell_1.execFile)(process.execPath, ['-e', "process.stdout.write('hello')"], { silent: true });
+            expect(result.stdout).toEqual('hello');
+            expect(result.code).toEqual(0);
+        });
+        it('should pass an argument through without the shell interpreting it', function () {
+            var result = (0, shell_1.execFile)(process.execPath, ['-e', 'process.stdout.write(process.argv[1])', metacharacters], { silent: true });
+            expect(result.stdout).toEqual(metacharacters);
+            expect(result.code).toEqual(0);
+        });
+        it('should pass an environment value through without the shell interpreting it', function () {
+            var result = (0, shell_1.execFile)(process.execPath, ['-e', 'process.stdout.write(process.env.PROBE)'], { silent: true, env: { PROBE: metacharacters } });
+            expect(result.stdout).toEqual(metacharacters);
+            expect(result.code).toEqual(0);
+        });
+        it('should answer with the exit code and stderr for an executable that fails', function () {
+            var result = (0, shell_1.execFile)(process.execPath, ['-e', "process.stderr.write('boom'); process.exit(3)"], { silent: true });
+            expect(result.code).toEqual(3);
+            expect(result.stderr).toContain('boom');
+        });
+    });
     describe('ls', function () {
         beforeEach(function () {
             fs_1.default.mkdirSync(path_1.default.join(root, 'sasjs-react-seed-app-main'));

package/build/utils/spec/zip.spec.js

@@ -84,6 +84,32 @@ var setEntryPlatform = function (zipPath, platform) {
     }
     fs_1.default.writeFileSync(zipPath, buffer);
 };
+/**
+ * Rewrites an entry name in the archive bytes, in both the local file header
+ * and the central directory record.
+ *
+ * yazl refuses to create an entry whose name is absolute or contains `..`, so
+ * a traversal entry has to be patched in after the fact. The replacement must
+ * be the same length as the original: both records carry the name length, and
+ * changing it would move every offset that follows.
+ */
+var replaceEntryName = function (zipPath, from, to) {
+    if (from.length !== to.length)
+        throw new Error('the replacement name must be the same length');
+    var buffer = fs_1.default.readFileSync(zipPath);
+    var fromBuffer = Buffer.from(from, 'utf8');
+    var toBuffer = Buffer.from(to, 'utf8');
+    var index = buffer.indexOf(fromBuffer);
+    var replaced = 0;
+    while (index !== -1) {
+        toBuffer.copy(buffer, index);
+        replaced++;
+        index = buffer.indexOf(fromBuffer, index + 1);
+    }
+    if (!replaced)
+        throw new Error("entry name not found in the archive: ".concat(from));
+    fs_1.default.writeFileSync(zipPath, buffer);
+};
 describe('zip', function () {
     var tmpRoot = path_1.default.join(__dirname, "zip-spec-".concat((0, test_1.generateUniqueTimestamp)()));
     var destDir = path_1.default.join(tmpRoot, 'dest');
@@ -279,5 +305,33 @@ describe('zip', function () {
                 }
             });
         }); });
+        /**
+         * The safety of `path.join(destDir, entry.fileName)` rests on the entry
+         * name never containing `..` or a leading slash. That is yauzl's
+         * validateFileName, which only runs because the reader is opened with
+         * decodeStrings - so the property is pinned here rather than left to the
+         * comment that documents it.
+         */
+        it('should refuse an entry whose name traverses out of the destination', function () { return __awaiter(void 0, void 0, void 0, function () {
+            var zipPath;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        zipPath = path_1.default.join(tmpRoot, 'traversal.zip');
+                        return [4 /*yield*/, makeZip([{ name: 'aa/evil.txt', content: 'pwned' }], zipPath)];
+                    case 1:
+                        _a.sent();
+                        replaceEntryName(zipPath, 'aa/evil.txt', '../evil.txt');
+                        return [4 /*yield*/, expect((0, zip_1.extractZip)(zipPath, destDir)).rejects.toThrow()
+                            // destDir/../evil.txt resolves to tmpRoot/evil.txt
+                        ];
+                    case 2:
+                        _a.sent();
+                        // destDir/../evil.txt resolves to tmpRoot/evil.txt
+                        expect(fs_1.default.existsSync(path_1.default.join(tmpRoot, 'evil.txt'))).toBeFalse();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
     });
 });

package/package.json

@@ -69,14 +69,13 @@
     "registry": "https://registry.npmjs.org"
   },
   "dependencies": {
-    "@sasjs/adapter": "5.1.0",
+    "@sasjs/adapter": "5.1.1",
     "@sasjs/core": "5.5.2",
-    "@sasjs/lint": "4.1.4",
-    "@sasjs/utils": "4.0.0",
+    "@sasjs/utils": "4.0.1",
     "axios": "1.20.0",
     "chalk": "4.1.2",
-    "dotenv": "17.4.2",
-    "js-base64": "3.9.3",
+    "dotenv": "18.0.8",
+    "js-base64": "3.9.4",
     "jsdom": "26.0.0",
     "lodash.uniqby": "4.7.0",
     "node-graphviz": "0.1.1",
@@ -94,6 +93,7 @@
     "@babel/preset-env": "7.29.7",
     "@babel/preset-typescript": "7.29.7",
     "@nogoo9/gitleaks": "8.30.1-post.2",
+    "@sasjs/lint": "4.2.0",
     "@types/debug": "4.1.13",
     "@types/find": "0.2.4",
     "@types/jest": "30.0.0",
@@ -105,15 +105,15 @@
     "@types/xml": "1.0.11",
     "@types/yauzl": "3.4.0",
     "@types/yazl": "3.3.1",
-    "babel-jest": "30.5.1",
+    "babel-jest": "30.5.2",
     "copyfiles": "2.4.1",
-    "jest": "30.5.1",
-    "jest-cli": "30.5.1",
-    "jest-environment-jsdom": "30.5.1",
-    "jest-extended": "4.0.2",
+    "jest": "30.5.2",
+    "jest-cli": "30.5.2",
+    "jest-environment-jsdom": "30.5.2",
+    "jest-extended": "7.0.0",
     "nodemon": "3.1.14",
-    "prettier": "3.9.6",
-    "ts-jest": "29.4.12",
+    "prettier": "3.9.10",
+    "ts-jest": "29.4.15",
     "ts-node": "10.9.2",
     "typescript": "5.9.3",
     "util": "0.12.5"
@@ -122,5 +122,8 @@
     "ws": "8.21.0",
     "nanoid": "3.3.18"
   },
-  "version": "5.0.2"
+  "peerDependencies": {
+    "@sasjs/lint": "^4.1.4"
+  },
+  "version": "5.1.0"
 }