@trustify-da/trustify-da-javascript-client 0.3.0-ea.a754fa8 → 0.3.0-ea.a87208f

package/dist/src/tools.js

@@ -42,6 +42,28 @@ export function getCustom(key, def = null, opts = {}) {
     }
     return key in process.env ? process.env[key] : key in opts && typeof opts[key] === 'string' ? opts[key] : def;
 }
+/**
+ * Validates that an executable path does not use directory traversal or relative segments.
+ * @param {string} binPath - The executable path to validate.
+ * @returns {string} The validated path.
+ * @throws {Error} If the path contains '..' segments or is a relative path with separators.
+ */
+function validateExecutablePath(binPath) {
+    if (typeof binPath !== 'string' || binPath.length === 0) {
+        throw new Error('Executable path rejected: expected a non-empty string');
+    }
+    if (binPath.startsWith('./') || binPath.startsWith('.\\')) {
+        throw new Error(`Executable path rejected: relative paths starting with './' are not allowed: ${binPath}`);
+    }
+    const segments = binPath.split(/[/\\]/);
+    if (segments.includes('..')) {
+        throw new Error(`Executable path rejected: path contains directory traversal segment (..): ${binPath}`);
+    }
+    if ((binPath.includes('/') || binPath.includes('\\')) && !path.isAbsolute(binPath)) {
+        throw new Error(`Executable path rejected: relative paths are not allowed, use an absolute path or a bare command name: ${binPath}`);
+    }
+    return binPath;
+}
 /**
  * Utility function for looking up custom variable for a binary path.
  * Will look in the environment variables (1) or in opts (2) for a key with TRUSTIFY_DA_x_PATH, x is an
@@ -53,7 +75,8 @@ export function getCustom(key, def = null, opts = {}) {
  * 		original name supplied
  */
 export function getCustomPath(name, opts = {}) {
-    return getCustom(`TRUSTIFY_DA_${name.toUpperCase()}_PATH`, name, opts);
+    const resolvedPath = getCustom(`TRUSTIFY_DA_${name.toUpperCase()}_PATH`, name, opts);
+    return validateExecutablePath(resolvedPath);
 }
 /**
  * Utility function for determining whether wrappers for build tools such as gradlew/mvnw should be

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@trustify-da/trustify-da-javascript-client",
-	"version": "0.3.0-ea.a754fa8",
+	"version": "0.3.0-ea.a87208f",
 	"description": "Code-Ready Dependency Analytics JavaScript API.",
 	"license": "Apache-2.0",
 	"homepage": "https://github.com/guacsec/trustify-da-javascript-client#README.md",
@@ -48,7 +48,7 @@
 	},
 	"dependencies": {
 		"@babel/core": "^7.23.2",
-		"@cyclonedx/cyclonedx-library": "^10.0.0",
+		"@yarnpkg/parsers": "^3.1.0",
 		"eslint-import-resolver-typescript": "^4.4.4",
 		"fast-glob": "^3.3.3",
 		"fast-xml-parser": "^5.3.4",
@@ -69,10 +69,12 @@
 	},
 	"devDependencies": {
 		"@babel/core": "^7.23.2",
+		"@cyclonedx/cyclonedx-library": "^10.2.0",
 		"@eslint/js": "^10.0.0",
 		"@trustify-da/trustify-da-api-model": "^2.0.12",
 		"@types/node": "^25.9.1",
 		"@types/which": "^3.0.4",
+		"ajv": "^8.20.0",
 		"babel-plugin-rewire": "^1.2.0",
 		"c8": "^11.0.0",
 		"chai": "^6.2.2",