@yamo/cli 1.3.0 → 1.3.2

package/README.md

@@ -1,4 +1,4 @@
-# 💻 YAMO CLI [![npm version](https://badge.fury.io/js/@yamo%2Fcli.svg)](https://www.npmjs.com/package/@yamo/cli)
+# 💻 YAMO CLI [![npm version](https://img.shields.io/npm/v/@yamo/cli?style=flat-square)](https://www.npmjs.com/package/@yamo/cli)
 
 The Command Line Interface for the YAMO Protocol. Now powered by `@yamo/core`.
 

package/dist/index.js

@@ -134,10 +134,20 @@ program
             const files = [{ name: "block.yamo", content }];
             if (outputMatch) {
                 const artifactName = outputMatch[1].trim();
+                // Security: Check for path traversal patterns in artifact name (Part 3: Security Fixes)
+                if (artifactName.includes('..') || artifactName.startsWith('/')) {
+                    throw new Error(`Invalid artifact name: ${artifactName} (path-like names are not allowed)`);
+                }
                 const artifactPath = path_1.default.join(path_1.default.dirname(file), artifactName);
-                if (fs_1.default.existsSync(artifactPath)) {
+                // Security: Resolve to absolute path and restrict to input file directory
+                const resolvedPath = path_1.default.resolve(artifactPath);
+                const inputDir = path_1.default.resolve(path_1.default.dirname(file));
+                if (!resolvedPath.startsWith(inputDir)) {
+                    throw new Error(`Artifact path outside allowed directory: ${artifactName}`);
+                }
+                if (fs_1.default.existsSync(resolvedPath)) {
                     console.log(chalk_1.default.cyan(`Bundling output: ${artifactName}`));
-                    files.push({ name: artifactName, content: fs_1.default.readFileSync(artifactPath, "utf8") });
+                    files.push({ name: artifactName, content: fs_1.default.readFileSync(resolvedPath, "utf8") });
                 }
             }
             let encryptionKey = undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yamo/cli",
-  "version": "1.3.0",
+  "version": "1.3.2",
   "description": "YAMO Protocol v0.4 - Command-line tools for blockchain integration",
   "main": "dist/index.js",
   "type": "commonjs",
@@ -16,7 +16,9 @@
   "scripts": {
     "build": "tsc && chmod +x dist/index.js",
     "prepublishOnly": "npm run build",
-    "start": "node dist/index.js"
+    "start": "node dist/index.js",
+    "test": "node --test test/**/*.test.js",
+    "test:security": "node --test test/security.test.js"
   },
   "keywords": [
     "yamo",