@the-bearded-bear/claude-craft 8.2.4 → 8.2.5

package/Dev/scripts/pack-repo-fallback.sh

@@ -39,27 +39,44 @@ if [[ "$FORMAT" != "markdown" && "$FORMAT" != "plain" ]]; then
   exit 1
 fi
 
+# Validate --output: relative path only, no traversal, no shell metachars
+if [[ "$OUTPUT" = /* ]] || [[ "$OUTPUT" == *".."* ]] || [[ "$OUTPUT" =~ [[:space:]\;\|\&\$\`\(\)\<\>] ]]; then
+  echo "❌ Invalid --output: must be a relative path without '..' or shell metacharacters" >&2
+  exit 1
+fi
+
+# Validate --exclude and --include: no shell metachars (prevents eval/grep injection)
+if [[ -n "$EXCLUDE_EXTRA" && "$EXCLUDE_EXTRA" =~ [[:space:]\;\|\&\$\`\(\)\<\>] ]]; then
+  echo "❌ Invalid --exclude: shell metacharacters are not allowed" >&2
+  exit 1
+fi
+if [[ -n "$INCLUDE" && "$INCLUDE" =~ [[:space:]\;\|\&\$\`\(\)\<\>] ]]; then
+  echo "❌ Invalid --include: shell metacharacters are not allowed" >&2
+  exit 1
+fi
+
 echo "📦 Pack repo (fallback shell) → $OUTPUT"
 echo "   Format: $FORMAT | Root: $(pwd)"
 
-# Build find excludes
-FIND_EXCLUDES=""
+# Build find args as an array (no eval, no injection)
+FIND_ARGS=()
 for excl in "${DEFAULT_EXCLUDES[@]}"; do
-  FIND_EXCLUDES+=" -not -path '*/$excl/*' -not -path '*/$excl'"
+  FIND_ARGS+=(-not -path "*/$excl/*" -not -path "*/$excl")
 done
 if [[ -n "$EXCLUDE_EXTRA" ]]; then
-  FIND_EXCLUDES+=" -not -path '*$EXCLUDE_EXTRA*'"
+  FIND_ARGS+=(-not -path "*$EXCLUDE_EXTRA*")
 fi
 
 # Collect files — respect .gitignore si disponible
 if command -v git &>/dev/null && git rev-parse --git-dir &>/dev/null; then
   FILES=$(git ls-files --cached --others --exclude-standard 2>/dev/null | grep -Ev "\.($BINARY_EXTS)$" || true)
 else
-  FILES=$(eval "find . -type f $FIND_EXCLUDES" | grep -Ev "\.($BINARY_EXTS)$" | sed 's|^\./||')
+  FILES=$(find . -type f "${FIND_ARGS[@]}" | grep -Ev "\.($BINARY_EXTS)$" | sed 's|^\./||')
 fi
 
 if [[ -n "$INCLUDE" ]]; then
-  FILES=$(echo "$FILES" | grep -E "$INCLUDE" || true)
+  # timeout on grep to prevent ReDoS
+  FILES=$(echo "$FILES" | timeout 5 grep -E "$INCLUDE" || true)
 fi
 
 FILE_COUNT=$(echo "$FILES" | grep -c . || echo 0)

package/cli/lib/update.js

@@ -5,11 +5,46 @@
 
 import fs from 'fs';
 import path from 'path';
-import { execSync } from 'child_process';
+import { spawnSync } from 'child_process';
 import c from './colors.js';
 import { listDirs } from './fs-utils.js';
 import { TECH_REGISTRY } from './tech-registry.js';
 
+// Security: reject paths into system directories to prevent accidental or malicious
+// installation outside the user's expected workspace.
+const FORBIDDEN_SYSTEM_DIRS = [
+  '/',
+  '/etc',
+  '/usr',
+  '/bin',
+  '/sbin',
+  '/boot',
+  '/lib',
+  '/var',
+  '/root',
+  '/proc',
+  '/sys',
+  '/dev',
+];
+
+function assertSafeTarget(targetPath) {
+  const resolved = path.resolve(targetPath);
+  for (const forbidden of FORBIDDEN_SYSTEM_DIRS) {
+    if (resolved === forbidden || resolved.startsWith(forbidden + path.sep)) {
+      throw new Error(`Refusing to operate on system directory: ${resolved}`);
+    }
+  }
+  return resolved;
+}
+
+// Security: enforce allowlist on language code (prevents argument injection via --lang).
+function assertSafeLang(lang) {
+  if (!/^[a-z]{2}$/.test(lang)) {
+    throw new Error(`Invalid --lang value: "${lang}" (expected 2-letter lowercase code)`);
+  }
+  return lang;
+}
+
 /**
  * Run the update command against a target directory.
  * @param {string} targetPath - Absolute path to the project directory
@@ -19,11 +54,14 @@ import { TECH_REGISTRY } from './tech-registry.js';
  * @param {string} cliRoot - Path to the CLI package root
  */
 function runUpdate(targetPath, options, cliRoot) {
-  const claudeDir = path.join(targetPath, '.claude');
-  const lang = options.lang || 'en';
+  // Security: validate inputs before any side effect (CWE-78, CWE-22).
+  const safeTarget = assertSafeTarget(targetPath);
+  const lang = assertSafeLang(options.lang || 'en');
+
+  const claudeDir = path.join(safeTarget, '.claude');
 
   console.log(`\n${c.bold}Claude Craft Update${c.reset}`);
-  console.log(`${c.dim}Directory: ${targetPath}${c.reset}\n`);
+  console.log(`${c.dim}Directory: ${safeTarget}${c.reset}\n`);
 
   // Verify existing installation
   if (!fs.existsSync(claudeDir)) {
@@ -60,16 +98,17 @@ function runUpdate(targetPath, options, cliRoot) {
 
   if (fs.existsSync(commonScript)) {
     console.log(`  ${c.cyan}Refreshing common rules...${c.reset}`);
-    try {
-      execSync(`bash "${commonScript}" --lang="${lang}" --force "${targetPath}"`, {
-        encoding: 'utf8',
-        timeout: 60_000,
-        stdio: 'pipe',
-      });
+    // Security: spawnSync with argv array — no shell interpretation, no injection.
+    const result = spawnSync('bash', [commonScript, `--lang=${lang}`, '--force', safeTarget], {
+      encoding: 'utf8',
+      timeout: 60_000,
+      stdio: 'pipe',
+    });
+    if (result.status === 0) {
       console.log(`  ${c.green}[OK]${c.reset} Common rules updated`);
       updated++;
-    } catch (e) {
-      console.log(`  ${c.red}[FAIL]${c.reset} Common rules: ${e.message}`);
+    } else {
+      console.log(`  ${c.red}[FAIL]${c.reset} Common rules: ${result.stderr || result.error?.message || 'unknown'}`);
     }
   }
 
@@ -84,16 +123,19 @@ function runUpdate(targetPath, options, cliRoot) {
     }
 
     console.log(`  ${c.cyan}Refreshing ${entry.displayName}...${c.reset}`);
-    try {
-      execSync(`bash "${script}" --lang="${lang}" --force "${targetPath}"`, {
-        encoding: 'utf8',
-        timeout: 60_000,
-        stdio: 'pipe',
-      });
+    // Security: spawnSync with argv array — no shell interpretation, no injection.
+    const result = spawnSync('bash', [script, `--lang=${lang}`, '--force', safeTarget], {
+      encoding: 'utf8',
+      timeout: 60_000,
+      stdio: 'pipe',
+    });
+    if (result.status === 0) {
       console.log(`  ${c.green}[OK]${c.reset} ${entry.displayName} updated`);
       updated++;
-    } catch (e) {
-      console.log(`  ${c.red}[FAIL]${c.reset} ${entry.displayName}: ${e.message}`);
+    } else {
+      console.log(
+        `  ${c.red}[FAIL]${c.reset} ${entry.displayName}: ${result.stderr || result.error?.message || 'unknown'}`
+      );
     }
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@the-bearded-bear/claude-craft",
-  "version": "8.2.4",
+  "version": "8.2.5",
   "description": "A comprehensive framework for AI-assisted development with Claude Code. Install standardized rules, agents, and commands for your projects.",
   "type": "module",
   "main": "cli/index.js",