claude-flow 3.5.23 → 3.5.25

package/v3/@claude-flow/cli/dist/src/transfer/storage/gcs.js

@@ -78,6 +78,10 @@ export async function uploadToGCS(content, options = {}) {
     const contentId = generateContentId(content);
     const checksum = crypto.createHash('sha256').update(content).digest('hex');
     const fileName = options.name || `${contentId}.cfp.json`;
+    // Validate filename to prevent path traversal
+    if (!/^[a-zA-Z0-9._\-]+$/.test(fileName) || fileName.includes('..')) {
+        throw new Error(`Invalid filename: ${fileName}`);
+    }
     const objectPath = config.prefix ? `${config.prefix}/${fileName}` : fileName;
     // S-1: Validate bucket name and object path to prevent command injection
     if (!isValidBucketName(config.bucket)) {
@@ -111,8 +115,11 @@ export async function uploadToGCS(content, options = {}) {
                 // Metadata update failed, but upload succeeded
             }
         }
-        // Clean up temp file
-        fs.unlinkSync(tempFile);
+        // Clean up temp file (validate path is within temp dir)
+        const resolvedTemp = path.resolve(tempFile);
+        if (resolvedTemp.startsWith(path.resolve(tempDir))) {
+            fs.unlinkSync(tempFile);
+        }
         const uri = `gs://${config.bucket}/${objectPath}`;
         const publicUrl = `https://storage.googleapis.com/${config.bucket}/${objectPath}`;
         console.log(`[GCS] Upload complete: ${uri}`);
@@ -126,9 +133,12 @@ export async function uploadToGCS(content, options = {}) {
         };
     }
     catch (error) {
-        // Clean up temp file on error
+        // Clean up temp file on error (validate path is within temp dir)
         try {
-            fs.unlinkSync(tempFile);
+            const resolvedTemp = path.resolve(tempFile);
+            if (resolvedTemp.startsWith(path.resolve(tempDir))) {
+                fs.unlinkSync(tempFile);
+            }
         }
         catch { /* ignore */ }
         throw new Error(`GCS upload failed: ${error}`);
@@ -150,13 +160,19 @@ export async function downloadFromGCS(uri, config) {
             downloadArgs.push(`--project=${cfg.projectId}`);
         execFileSync('gcloud', downloadArgs, { encoding: 'utf-8', stdio: 'pipe' });
         const content = fs.readFileSync(tempFile);
-        fs.unlinkSync(tempFile);
+        const resolvedTemp = path.resolve(tempFile);
+        if (resolvedTemp.startsWith(path.resolve(tempDir))) {
+            fs.unlinkSync(tempFile);
+        }
         console.log(`[GCS] Downloaded ${content.length} bytes`);
         return content;
     }
     catch (error) {
         try {
-            fs.unlinkSync(tempFile);
+            const resolvedTemp = path.resolve(tempFile);
+            if (resolvedTemp.startsWith(path.resolve(tempDir))) {
+                fs.unlinkSync(tempFile);
+            }
         }
         catch { /* ignore */ }
         console.error(`[GCS] Download failed: ${error}`);

package/v3/@claude-flow/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.5.23",
+  "version": "3.5.25",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",