@vixoniccom/module-packager 2.10.3-dev.7 → 2.11.0-dev.0

package/dist/main.js

@@ -4,7 +4,7 @@ import commandLineArgs from 'command-line-args';
 import path from 'path';
 import webpack from 'webpack';
 import WebpackDevServer from 'webpack-dev-server';
-import { exec } from 'child_process';
+import { spawn } from 'child_process';
 import { fileURLToPath } from 'url';
 import fs from 'fs';
 import archiver from 'archiver';
@@ -12,9 +12,11 @@ import clc from 'cli-color';
 import { Configuration } from '@vixoniccom/modules';
 import tsNode from 'ts-node';
 import { createRequire } from 'module';
+import which from 'which';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 const electronPath = path.join(__dirname, 'electron.js');
+const npxPath = which.sync('npx');
 const optionDefinitions = [
     { name: 'externals', type: String, defaultValue: [], multiple: true },
     { name: 'target', type: String, defaultValue: 'web' },
@@ -28,9 +30,91 @@ const optionDefinitions = [
     { name: 'tsOverride', type: Boolean }
 ];
 const options = commandLineArgs(optionDefinitions);
-if (options.target !== 'electron-renderer' && options.externals.length > 0) {
-    throw new Error(`Can't use external dependencies if target is not electron-renderer.`);
+// Validación de entrada mejorada
+function validateOptions(options) {
+    if (options.target !== 'electron-renderer' && options.externals.length > 0) {
+        throw new Error(`Can't use external dependencies if target is not electron-renderer.`);
+    }
+    // Validar puerto
+    if (options.port < 1 || options.port > 65535) {
+        throw new Error('Port must be between 1 and 65535');
+    }
+    // Validar modo
+    const validModes = ['build', 'watch', 'run', 'generate-configuration', 'validate-configuration'];
+    if (!validModes.includes(options.mode)) {
+        throw new Error(`Invalid mode. Must be one of: ${validModes.join(', ')}`);
+    }
+}
+// Función para sanitizar rutas
+function sanitizePath(inputPath) {
+    // Prevenir path traversal
+    if (inputPath.includes('..') || inputPath.includes('~')) {
+        throw new Error('Invalid path: path traversal detected');
+    }
+    return path.resolve(inputPath);
+}
+// Función centralizada para crear argumentos de Electron
+function createElectronArgs(mode) {
+    return [
+        electronPath,
+        '--src', sanitizePath(options.src),
+        '--build', sanitizePath(options.build),
+        '--port', String(options.port),
+        '--mode', mode,
+        '--config', options.config,
+        '--externals', Array.isArray(options.externals) ? options.externals.join(',') : ''
+    ];
+}
+// Función centralizada para manejar procesos Electron
+function spawnElectronProcess(mode) {
+    const args = createElectronArgs(mode);
+    const nodeEnv = mode === 'run' ? 'production' : 'development';
+    const child = spawn(npxPath, ['electron', ...args], {
+        cwd: __dirname,
+        env: {
+            ...process.env,
+            NODE_ENV: nodeEnv,
+            ELECTRON_DISABLE_SECURITY_WARNINGS: 'true',
+            NODE_NO_WARNINGS: '1'
+        },
+        stdio: 'inherit'
+    });
+    // Manejo centralizado de logs
+    setupChildProcessLogging(child);
+    return child;
 }
+// Función para manejar logging de procesos hijo
+function setupChildProcessLogging(child) {
+    child.stdout?.on('data', (data) => {
+        const output = data.toString();
+        if (!shouldFilterLog(output)) {
+            process.stdout.write(output);
+        }
+    });
+    child.stderr?.on('data', (data) => {
+        const output = data.toString();
+        if (!shouldFilterLog(output)) {
+            process.stderr.write(output);
+        }
+    });
+}
+// Función centralizada para compilar webpack
+async function compileWebpack() {
+    const cfgPath = path.resolve(__dirname, '..', 'dist/webpack.config.js');
+    const webpackConfigFactory = (await import(cfgPath)).default;
+    const compiler = webpack(webpackConfigFactory(options));
+    return new Promise((resolve, reject) => {
+        compiler.run((err, stats) => {
+            if (err)
+                return reject(err);
+            if (stats?.hasErrors()) {
+                return reject(new Error(stats.toString({ all: false, errors: true, colors: true })));
+            }
+            compiler.close(closeErr => (closeErr ? reject(closeErr) : resolve()));
+        });
+    });
+}
+validateOptions(options);
 if (options.mode === 'build') {
     pack(() => {
         if (options.target === 'electron-renderer') {
@@ -59,6 +143,7 @@ async function pack(callback) {
     console.log(clc.blue('Building module...'));
     validateConfiguration();
     const configPath = path.resolve(__dirname, options.config);
+    console.log("🚀 ~ pack ~ configPath:", configPath);
     try {
         const webpackConfig = (await import(configPath)).default(options);
         function handleWebpackError(err) {
@@ -106,19 +191,27 @@ async function pack(callback) {
 }
 function installExternals(callback) {
     let externals = options.externals.map((x) => {
-        return `${x}@${JSON.parse(fs.readFileSync(path.resolve(options.src, '..', 'node_modules', x, 'package.json'), 'utf8')).version}`;
+        // Validar nombre del paquete
+        if (!/^[@a-z0-9-_./]+$/i.test(x)) {
+            throw new Error(`Invalid package name: ${x}`);
+        }
+        const packageJsonPath = sanitizePath(path.resolve(options.src, '..', 'node_modules', x, 'package.json'));
+        return `${x}@${JSON.parse(fs.readFileSync(packageJsonPath, 'utf8')).version}`;
     });
     if (externals.length) {
-        externals = externals.join(' ');
-        console.log(clc.blue(`Installing externals ${externals}...`));
-        exec(`npm install --prefix ./ --production ${externals}`, {
-            cwd: options.build
-        }, (err, _stdout) => {
-            if (err)
-                throw err;
+        console.log(clc.blue(`Installing externals ${externals.join(', ')}...`));
+        const npmPath = which.sync('npm');
+        const child = spawn(npmPath, ['install', '--prefix', './', '--production', ...externals], { cwd: sanitizePath(options.build), stdio: 'inherit' });
+        child.on('exit', (code) => {
+            if (code !== 0) {
+                return callback?.(new Error(`npm install failed with code ${code}`));
+            }
             console.log(clc.green('Externals installed.'));
             callback?.(null);
         });
+        child.on('error', (err) => {
+            callback?.(err);
+        });
     }
     else {
         callback?.(null);
@@ -127,11 +220,13 @@ function installExternals(callback) {
 function zip() {
     console.log(clc.blue('Archiving...'));
     console.log(clc.blue('Cleaning build...'));
-    console.log("[DEBUG] Cleaning build folder", path.resolve(options.build, '../', 'build.zip'));
-    let output = fs.createWriteStream(path.resolve(options.build, '../', 'build.zip'));
+    const buildPath = sanitizePath(options.build);
+    const zipPath = path.resolve(buildPath, '../', 'build.zip');
+    console.log("[DEBUG] Cleaning build folder", zipPath);
+    let output = fs.createWriteStream(zipPath);
     let archive = archiver('zip');
     archive.pipe(output);
-    archive.directory(path.resolve(options.build), './');
+    archive.directory(buildPath, './');
     archive.finalize();
     output.on('close', function () {
         console.log(clc.green('Generated build.zip.'));
@@ -152,93 +247,12 @@ async function watch() {
         historyApiFallback: true
     }, compiler);
     await server.start();
-    const cmd = [
-        'npx', 'electron', electronPath,
-        '--src', path.resolve(options.src),
-        '--build', path.resolve(options.build),
-        '--port', String(options.port),
-        '--mode', 'watch',
-        '--config', options.config,
-        '--externals', options.externals.join(',')
-    ].join(' ');
-    const child = exec(cmd, {
-        cwd: __dirname,
-        env: {
-            ...process.env,
-            NODE_ENV: 'development',
-            ELECTRON_DISABLE_SECURITY_WARNINGS: 'true',
-            NODE_NO_WARNINGS: '1'
-        }
-    });
-    // Filtrar logs no deseados
-    child.stdout?.on('data', (data) => {
-        const output = data.toString();
-        if (!shouldFilterLog(output)) {
-            process.stdout.write(output);
-        }
-    });
-    child.stderr?.on('data', (data) => {
-        const output = data.toString();
-        if (!shouldFilterLog(output)) {
-            process.stderr.write(output);
-        }
-    });
+    spawnElectronProcess('watch');
 }
 async function run() {
-    await new Promise((resolve, reject) => pack((err) => (err ? reject(err) : resolve())));
-    const cfgPath = path.resolve(__dirname, '..', 'dist/webpack.config.js');
-    const webpackConfigFactory = (await import(cfgPath)).default;
-    const compiler = webpack(webpackConfigFactory(options));
-    await new Promise((resolve, reject) => {
-        compiler.run((err, stats) => {
-            if (err)
-                return reject(err);
-            if (stats?.hasErrors()) {
-                return reject(new Error(stats.toString({ all: false, errors: true, colors: true })));
-            }
-            compiler.close(closeErr => (closeErr ? reject(closeErr) : resolve()));
-        });
-    });
-    const cmd = [
-        'npx',
-        'electron',
-        electronPath,
-        '--src',
-        path.resolve(options.src),
-        '--build',
-        path.resolve(options.build),
-        '--port',
-        String(options.port),
-        '--mode',
-        'run',
-        '--config',
-        options.config,
-        '--externals',
-        options.externals.join(',')
-    ].join(' ');
-    const child = exec(cmd, {
-        cwd: __dirname,
-        env: {
-            ...process.env,
-            NODE_ENV: 'production',
-            // Suprimir warnings en producción también
-            ELECTRON_DISABLE_SECURITY_WARNINGS: 'true',
-            NODE_NO_WARNINGS: '1'
-        },
-    });
-    // Aplicar el mismo filtrado
-    child.stdout?.on('data', (data) => {
-        const output = data.toString();
-        if (!shouldFilterLog(output)) {
-            process.stdout.write(output);
-        }
-    });
-    child.stderr?.on('data', (data) => {
-        const output = data.toString();
-        if (!shouldFilterLog(output)) {
-            process.stderr.write(output);
-        }
-    });
+    await new Promise((resolve) => pack((err) => (err ? console.log(err) : resolve())));
+    await compileWebpack();
+    spawnElectronProcess('run');
 }
 async function loadConfiguration() {
     const require = createRequire(import.meta.url);
@@ -250,14 +264,15 @@ async function loadConfiguration() {
             checkJs: false
         }
     });
-    const configPath = path.resolve(options.confDefinition, 'index.ts');
+    const configPath = sanitizePath(path.resolve(options.confDefinition, 'index.ts'));
     return require(configPath).configuration;
 }
 async function generateConfiguration() {
     try {
         let configuration = await loadConfiguration();
-        fs.writeFileSync(path.resolve(options.src, 'parameters.d.ts'), configuration.declarationFileString);
-        fs.writeFileSync(path.resolve(options.src, '..', 'configuration.json'), JSON.stringify(configuration, undefined, 2));
+        const srcPath = sanitizePath(options.src);
+        fs.writeFileSync(path.resolve(srcPath, 'parameters.d.ts'), configuration.declarationFileString);
+        fs.writeFileSync(path.resolve(srcPath, '..', 'configuration.json'), JSON.stringify(configuration, undefined, 2));
         console.log(clc.green(`Configuration generated`));
     }
     catch (e) {
@@ -267,11 +282,12 @@ async function generateConfiguration() {
 }
 function validateConfiguration() {
     try {
-        const jsonPath = path.resolve(options.src, '../', 'configuration.json');
+        const srcPath = sanitizePath(options.src);
+        const jsonPath = path.resolve(srcPath, '../', 'configuration.json');
         const json = JSON.parse(fs.readFileSync(jsonPath, 'utf8'));
         const conf = Configuration.fromJSON(json);
         if (conf.durationFormula) {
-            const valuesPath = path.resolve(options.src, 'test', 'parameters.json');
+            const valuesPath = path.resolve(srcPath, 'test', 'parameters.json');
             const values = JSON.parse(fs.readFileSync(valuesPath, 'utf8'));
             console.log('Validate duration');
             console.log('Duration on undefined:', conf.getDuration({}), 'seconds');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vixoniccom/module-packager",
-  "version": "2.10.3-dev.7",
+  "version": "2.11.0-dev.0",
   "type": "module",
   "bin": {
     "vixonic-module-packager": "./dist/main.js"
@@ -55,6 +55,7 @@
     "@types/command-line-args": "^5.2.3",
     "@types/node": "^20.11.25",
     "@types/webpack-env": "^1.18.8",
+    "@types/which": "^3.0.4",
     "concurrently": "^9.1.2",
     "css-loader": "^7.1.2",
     "npm-run-all": "^4.1.5",