configorama 0.9.12 → 0.9.14

package/src/resolvers/valueFromGit.js

@@ -10,6 +10,21 @@ const { findProjectRoot } = require('../utils/paths/findProjectRoot')
 const GIT_PREFIX = 'git'
 const gitVariableSyntax = RegExp(/^git:/g)
 
+/**
+ * Check if a directory is inside a git repository.
+ * @param {string} [dir] - Directory to check (defaults to process.cwd())
+ * @returns {boolean}
+ */
+function isGitRepo(dir) {
+  const start = dir || process.cwd()
+  try {
+    if (!fs.existsSync(start)) return false
+    return findProjectRoot(start) !== null
+  } catch (err) {
+    return false
+  }
+}
+
 /**
  * Execute a shell command
  * @param {string} cmd - Command to execute
@@ -27,6 +42,43 @@ async function _exec(cmd, options = { timeout: 1000 }) {
   })
 }
 
+/**
+ * Execute a command with arguments array (safe from shell injection)
+ * @param {string} command - Command to execute
+ * @param {string[]} args - Arguments array
+ * @param {import('child_process').ExecFileOptions} [options] - ExecFile options
+ * @returns {Promise<string>}
+ */
+async function _execFile(command, args, options = { timeout: 1000 }) {
+  return new Promise((resolve, reject) => {
+    childProcess.execFile(command, args, options, (err, stdout) => {
+      if (err) {
+        return reject(err)
+      }
+      return resolve(String(stdout).trim())
+    })
+  })
+}
+
+/**
+ * Run a git command and return undefined on failure. This lets the variable
+ * resolver fall through to user-provided fallbacks (e.g. `${git:branch, "main"}`)
+ * when not in a git repo, without surfacing raw `fatal: not a git repository`
+ * errors. When no fallback is provided, the outer resolver in main.js still
+ * produces a clear "Unable to resolve config variable" error pointing at the
+ * exact config path.
+ *
+ * @param {() => Promise<string>} cmdFn - Function that runs the git command
+ * @returns {Promise<string|undefined>}
+ */
+async function _safeGit(cmdFn) {
+  try {
+    return await cmdFn()
+  } catch (err) {
+    return undefined
+  }
+}
+
 // TODO denote computed fields in metadata
 /*
 {
@@ -65,14 +117,21 @@ function createResolver(cwd) {
     const variable = variableString.split(`${GIT_PREFIX}:`)[1]
     let value = null
     // console.log('createResolver variableString', variableString)
+
+    // If we're not inside a git repository, every git: variable resolves to
+    // undefined. This lets fallbacks like `${git:branch, "main"}` work, and
+    // when there's no fallback the outer resolver throws a clear "Unable to
+    // resolve config variable" error pointing at the config path.
+    if (!isGitRepo(cwd)) {
+      return undefined
+    }
+
     if (variable.match(/^remote/i)) {
       const hasParams = functionRegex.exec(variableString)
       const remoteName = (hasParams && hasParams[2]) ? formatFunctionArgs(hasParams[2]) : 'origin'
-      value = await getGitRemote(remoteName)
-      return value
+      return _safeGit(() => getGitRemote(remoteName))
     }
 
-    const verifyMsg = `Verify the cwd has a .git directory\n`
     const normalizedVar = (variable || '').toLowerCase()
     // console.log('normalizedVar', normalizedVar)
 
@@ -82,7 +141,7 @@ function createResolver(cwd) {
       const funcName = argsMatch[1]
       const args = argsMatch[2]
       if (funcName === 'timestamp' && args) {
-        value = await getGitTimestamp(args, cwd)
+        value = await getGitTimestamp(args, cwd, false)
       }
     }
 
@@ -91,55 +150,61 @@ function createResolver(cwd) {
       case GIT_KEYS.repo:
       case 'repository':
       case 'reposlug':
-      case 'repo-slug':
-        const urla = await getGitRemote()
+      case 'repo-slug': {
+        const urla = await _safeGit(() => getGitRemote())
+        if (!urla) return undefined
         const parseda = GitUrlParse(urla)
         value = parseda.full_name
-        break;
+        break
+      }
       // Repo name
       case GIT_KEYS.name:
       case 'reponame': // repoName
-      case 'repo-name':
-        value = await _exec('basename `git rev-parse --show-toplevel`')
-        break;
+      case 'repo-name': {
+        const toplevel = await _safeGit(() => _execFile('git', ['rev-parse', '--show-toplevel']))
+        if (!toplevel) return undefined
+        value = path.basename(toplevel)
+        break
+      }
       // Repo org or owner
       case GIT_KEYS.org:
       case 'owner':
       case 'organization':
       case 'repoowner': // repoOwner
-      case 'repo-owner':
-        const url = await getGitRemote()
+      case 'repo-owner': {
+        const url = await _safeGit(() => getGitRemote())
+        if (!url) return undefined
         const parsed = GitUrlParse(url)
         value = parsed.organization || parsed.owner
-        break;
+        break
+      }
       // Repo name
       case GIT_KEYS.dir:
       case 'directory':
       case 'dirpath': // dirPath
       case 'dir-path':
-      case 'dir_path':
-        const gitBasePath = await _exec('git rev-parse --show-toplevel')
+      case 'dir_path': {
+        const gitBasePath = await _safeGit(() => _execFile('git', ['rev-parse', '--show-toplevel']))
+        if (!gitBasePath) return undefined
         if (cwd) {
           const subPath = cwd.replace(gitBasePath, '')
-          const branch = await _exec('git rev-parse --abbrev-ref HEAD')
-          const url = await getGitRemote()
-          value = (subPath) ? `${url}/tree/${branch}${subPath}` : url
+          const branch = await _safeGit(() => _execFile('git', ['rev-parse', '--abbrev-ref', 'HEAD']))
+          const url = await _safeGit(() => getGitRemote())
+          if (!url) return undefined
+          value = (subPath && branch) ? `${url}/tree/${branch}${subPath}` : url
         }
-        break;
+        break
+      }
       // Repo url
       case GIT_KEYS.url:
       case 'repourl': // repoUrl
       case 'repo-url':
-        value = await getGitRemote()
-        break;
+        value = await _safeGit(() => getGitRemote())
+        break
       // Current commit sha
       case 'sha':
       case 'sha1':
-        try {
-          value = await _exec('git rev-parse --short HEAD')
-        } catch (err) {
-          throw new Error(`\${git:sha1} error ${verifyMsg}`)
-        }
+        value = await _safeGit(() => _execFile('git', ['rev-parse', '--short', 'HEAD']))
         break
       // Current commit full sha
       case GIT_KEYS.commit:
@@ -147,11 +212,7 @@ function createResolver(cwd) {
       case 'commit-sha':
       case 'commithash':
       case 'commit-hash':
-        try {
-          value = await _exec('git rev-parse HEAD')
-        } catch (err) {
-          throw new Error(`\${git:commit} error. ${verifyMsg}`)
-        }
+        value = await _safeGit(() => _execFile('git', ['rev-parse', 'HEAD']))
         break
       // Branches
       case GIT_KEYS.branch:
@@ -159,11 +220,7 @@ function createResolver(cwd) {
       case 'branch-name':
       case 'currentbranch': // currentBranch
       case 'current-branch':
-        try {
-          value = await _exec('git rev-parse --abbrev-ref HEAD')
-        } catch (err) {
-          throw new Error(`\${git:branch} error. ${verifyMsg}`)
-        }
+        value = await _safeGit(() => _execFile('git', ['rev-parse', '--abbrev-ref', 'HEAD']))
         break
       // Commit msg
       case GIT_KEYS.message:
@@ -172,42 +229,36 @@ function createResolver(cwd) {
       case 'commit-message':
       case 'commitmsg': // commitMsg
       case 'commit-msg':
-        try {
-          value = await _exec('git log -1 --pretty=%B')
-        } catch (err) {
-          throw new Error(`\${git:message} error. ${verifyMsg}`)
-        }
-        break;
+        value = await _safeGit(() => _execFile('git', ['log', '-1', '--pretty=%B']))
+        break
       // Git tags
       case GIT_KEYS.tag:
       case 'describe':
-        try {
-          value = await _exec('git describe --always')
-        } catch (err) {
-          throw new Error(`\${git:describeLight} error. ${verifyMsg}`)
-        }
-        break;
+        value = await _safeGit(() => _execFile('git', ['describe', '--always']))
+        break
       // Git tags
       case 'describeLight':
       case 'describelight':
       case 'describe-light':
-        try {
-          value = await _exec('git describe --always --tags')
-        } catch (err) {
-          throw new Error(`\${git:describeLight} error. ${verifyMsg}`)
-        }
-        break;
+        value = await _safeGit(() => _execFile('git', ['describe', '--always', '--tags']))
+        break
       // Is branch dirty
       case 'isDirty':
       case 'isdirty':
-      case 'is-dirty':
-        const writeTree = await _exec('git write-tree')
-        const changes = await _exec(`git diff-index ${writeTree} --`)
+      case 'is-dirty': {
+        const writeTree = await _safeGit(() => _execFile('git', ['write-tree']))
+        if (!writeTree) return undefined
+        const changes = await _safeGit(() => _execFile('git', ['diff-index', writeTree.trim(), '--']))
+        if (changes === undefined) return undefined
         value = `${changes.length > 0}`
         break
+      }
       default:
         if (!value) {
-          throw new Error(`Git variable ${variable} is unknown. Candidates are 'describe', 'describeLight', 'sha1', 'commit', 'branch', 'message', 'repository'`)
+          // Unknown variable name (likely a typo). This is a config error,
+          // not an environment one, so throw a helpful message listing the
+          // valid keys.
+          throw new Error(`Git variable "${variable}" is unknown. Valid options: ${Object.values(GIT_KEYS).join(', ')}`)
         }
     }
     return value
@@ -230,28 +281,16 @@ async function getGitTimestamp(_file, cwd, throwOnMissing = true) {
     throw new Error('File path must be a string')
   }
 
-  // Check for suspicious characters and patterns that could be used for command injection or path traversal
-  const dangerousPatterns = [
-    /[;&|`$]/,  // Command injection chars
-    // /\.\.\//,   // Directory traversal
-    // /\.\./,     // Directory traversal
-    // /^[\/\\]/,  // Absolute paths
-    /[\x00-\x1f\x7f-\x9f]/  // Control characters
-  ]
-
-  if (dangerousPatterns.some(pattern => pattern.test(_file))) {
-    throw new Error('Invalid characters or pattern in file path')
-  }
+  // Strip surrounding quotes and leading slash
+  const file = _file
+    .replace(/^['"]|['"]$/g, '')
+    .replace(/^\//, '')
 
-  // Only allow alphanumeric chars, dashes, underscores, forward slashes, and dots
-  if (!/^[a-zA-Z0-9-_./\\'"]+$/.test(_file)) {
+  // Reject control characters
+  if (/[\x00-\x1f\x7f-\x9f]/.test(file)) {
     throw new Error('File path contains invalid characters')
   }
 
-  // Normalize path and remove leading slash
-  const file = _file
-    .replace(/^\//, '')
-
   const cachedTimestamp = cache.get(file)
   if (cachedTimestamp) return cachedTimestamp
 
@@ -263,10 +302,7 @@ async function getGitTimestamp(_file, cwd, throwOnMissing = true) {
   }
 
   try {
-    const cmd = `git log -1 --pretty="%ai" ${file}`
-    // console.log('cmd', cmd)
-    // console.log('cwd', cwd)
-    const output = await _exec(cmd, { cwd })
+    const output = await _execFile('git', ['log', '-1', '--pretty=%ai', '--', file], { cwd })
     const date = new Date(output)
     const dateString = date.toISOString()
     cache.set(file, dateString)
@@ -281,8 +317,8 @@ async function getGitTimestamp(_file, cwd, throwOnMissing = true) {
     }
 
     try {
-      const backupFile = path.join(projectRoot, _file)
-      const output = await _exec(`git log -1 --pretty="%ai" ${backupFile}`, { cwd: projectRoot })
+      const backupFile = path.join(projectRoot, file)
+      const output = await _execFile('git', ['log', '-1', '--pretty=%ai', '--', backupFile], { cwd: projectRoot })
       const date = new Date(output)
       const dateString = date.toISOString()
       cache.set(file, dateString)
@@ -296,14 +332,19 @@ async function getGitTimestamp(_file, cwd, throwOnMissing = true) {
   }
 }
 
+const remoteCache = new Map()
+
 async function getGitRemote(name = 'origin') {
-  const remoteValues = await _exec('git remote -v')
+  if (remoteCache.has(name)) {
+    return remoteCache.get(name)
+  }
+  const remoteValues = await _execFile('git', ['remote', '-v'])
   const remotes = remoteValues.toString().split(os.EOL)
     .filter(function filterOnlyFetchRows(remote) {
       return remote.match('(fetch)')
     })
     .map(function mapRemoteLineToObject(remote) {
-      var parts = remote.split('\t')
+      const parts = remote.split('\t')
       if (parts.length < 2) {
         return
       }
@@ -323,7 +364,6 @@ async function getGitRemote(name = 'origin') {
 
   if (!originUrl) {
     throw new Error(`No git remote "${name}" found. Please double check your remote names`)
-    return
   }
   // console.log('originUrl', originUrl)
   const parsed = GitUrlParse(originUrl)
@@ -331,7 +371,9 @@ async function getGitRemote(name = 'origin') {
   // @TODO finish git api
   // console.log('parsed', parsed)
   if (parsed && parsed.source && parsed.full_name) {
-    return `https://${parsed.source}/${parsed.full_name}`
+    const result = `https://${parsed.source}/${parsed.full_name}`
+    remoteCache.set(name, result)
+    return result
   }
 }
 

package/src/resolvers/valueFromNumber.js

@@ -1,5 +1,10 @@
-const isNumber = require('lodash.isnumber')
+// Resolves numeric literal variables to their Number values
+const { isNumber } = require('../utils/lodash')
 
+/**
+ * @param {string} variableString
+ * @returns {boolean}
+ */
 function isNumberVariable(variableString) {
   if (!variableString || variableString.trim().length === 0) {
     return false
@@ -8,6 +13,10 @@ function isNumberVariable(variableString) {
   return !isNaN(num) && isNumber(num)
 }
 
+/**
+ * @param {string} variableString
+ * @returns {Promise<number>}
+ */
 function getValueFromNumber(variableString) {
   return Promise.resolve(Number(variableString))
 }

package/src/resolvers/valueFromOptions.js

@@ -1,14 +1,10 @@
-
+// Resolves values from CLI option flags
+// Matches ${opt:FLAG_NAME} syntax with optional fallback values
 const optRefSyntax = RegExp(/^opt:/g)
 
 function getValueFromOptions(variableString, options) {
   const requestedOption = variableString.split(':')[1]
-  let valueToPopulate
-  if (requestedOption !== '' || '' in options) {
-    valueToPopulate = options[requestedOption]
-  } else {
-    valueToPopulate = options
-  }
+  const valueToPopulate = options[requestedOption]
   return Promise.resolve(valueToPopulate)
 }
 

package/src/resolvers/valueFromParam.js

@@ -1,4 +1,5 @@
-
+// Resolves values from named parameters
+// Matches ${param:KEY} syntax with optional fallback values
 const paramRefSyntax = RegExp(/^param:/g)
 
 /**

package/src/types.d.ts

@@ -2,7 +2,7 @@
 // This file provides TypeScript support for validating configuration variables
 
 // Valid variable prefixes supported by configorama
-export type KnownVariablePrefix = 'env:' | 'opt:' | 'self:' | 'file:' | 'git:' | 'cron:'
+export type KnownVariablePrefix = 'env:' | 'opt:' | 'self:' | 'file:' | 'git:' | 'cron:' | 'param:'
 
 // Quoted string literal type for fallback values
 type QuotedString = `"${string}"` | `'${string}'`

package/src/utils/handleSignalEvents.js

@@ -1,3 +1,4 @@
+// Registers graceful shutdown handlers for SIGINT/SIGTERM/SIGBREAK
 const readline = require('readline')
 
 function handleSignalEvents() {
@@ -29,11 +30,6 @@ Exit received. Waiting for current operation to finish...
     rl.on('SIGBREAK', () => process.emit('SIGBREAK'))
   }
 
-  // Remove any existing listeners before adding new ones
-  process.removeAllListeners('SIGINT')
-  process.removeAllListeners('SIGTERM') 
-  process.removeAllListeners('SIGBREAK')
-
   process.on('SIGINT', () => {
     global.signalEventHandling.SIGINTCount += 1
     global.signalEventHandling.shouldExitGracefully = true

package/src/utils/lodash.js

@@ -1,70 +1,124 @@
-const isArray = require('lodash.isarray')
-const isString = require('lodash.isstring')
-const isNumber = require('lodash.isnumber')
-const isObject = require('lodash.isobject')
-const isDate = require('lodash.isdate')
-const isRegExp = require('lodash.isregexp')
-const isFunction = require('lodash.isfunction')
-const isEmpty = require('lodash.isempty')
+// Native replacements for lodash utilities used across the codebase
+const isArray = Array.isArray
+const isString = (val) => typeof val === 'string'
+const isNumber = (val) => typeof val === 'number' && !isNaN(val)
+const isObject = (val) => val != null && typeof val === 'object'
+const isDate = (val) => val instanceof Date
+const isRegExp = (val) => val instanceof RegExp
+const isFunction = (val) => typeof val === 'function'
+
+/**
+ * @param {*} val
+ * @returns {boolean}
+ */
+function isEmpty(val) {
+  if (val == null) return true
+  if (isArray(val) || isString(val)) return val.length === 0
+  if (val instanceof Map || val instanceof Set) return val.size === 0
+  if (isObject(val)) return Object.keys(val).length === 0
+  return false
+}
+
+// Non-trivial utilities kept as dependencies
 const camelCase = require('lodash.camelcase')
 const kebabCase = require('lodash.kebabcase')
-const capitalize = require('lodash.capitalize')
-const split = require('lodash.split')
-const map = require('lodash.map')
-const mapValues = require('lodash.mapvalues')
-const assign = require('lodash.assign')
 const cloneDeep = require('lodash.clonedeep')
 
-// Custom implementation of lodash.set
+/**
+ * @param {string} str
+ * @returns {string}
+ */
+function capitalize(str) {
+  if (!str) return ''
+  const s = String(str)
+  return s.charAt(0).toUpperCase() + s.slice(1).toLowerCase()
+}
+
+/**
+ * @param {*[]} arr
+ * @param {Function} fn
+ * @returns {*[]}
+ */
+function map(arr, fn) {
+  if (arr == null) return []
+  return Array.prototype.map.call(arr, fn)
+}
+
+/**
+ * @param {Object} obj
+ * @param {Function} fn
+ * @returns {Object}
+ */
+function mapValues(obj, fn) {
+  if (obj == null) return {}
+  const result = {}
+  const keys = Object.keys(obj)
+  for (let i = 0; i < keys.length; i++) {
+    result[keys[i]] = fn(obj[keys[i]], keys[i], obj)
+  }
+  return result
+}
+
+/**
+ * @param {Object} object - Target object
+ * @param {string|string[]} path - Dot-delimited path or array of keys
+ * @param {*} value - Value to set
+ * @returns {Object} The mutated object
+ */
 function set(object, path, value) {
   if (object === null || typeof object !== 'object') {
-    return object;
+    return object
   }
-  
+
   const keys = Array.isArray(path) ? path : String(path)
     .split('.')
     .map(key => {
-      const numKey = Number(key);
-      return Number.isInteger(numKey) && numKey >= 0 ? numKey : key;
-    });
-  
-  let current = object;
-  const lastIndex = keys.length - 1;
-  
+      const numKey = Number(key)
+      return Number.isInteger(numKey) && numKey >= 0 ? numKey : key
+    })
+
+  let current = object
+  const lastIndex = keys.length - 1
+
   for (let i = 0; i < lastIndex; i++) {
     const key = keys[i]
-    
+
     // Check if value is undefined, null, or not an object (primitives can't have properties)
     if (current[key] == null || typeof current[key] !== 'object') {
       // Create appropriate container based on next key type
-      current[key] = Number.isInteger(keys[i + 1]) && keys[i + 1] >= 0 ? [] : {}
+      const nextKey = keys[i + 1]
+      current[key] = Number.isInteger(nextKey) && /** @type {number} */ (nextKey) >= 0 ? [] : {}
     }
-    
+
     current = current[key]
   }
-  
-  current[keys[lastIndex]] = value;
-  return object;
+
+  current[keys[lastIndex]] = value
+  return object
 }
 
 // Cache for trim regex patterns (perf: avoid recompilation)
 const trimRegexCache = new Map()
 
-// Custom implementation of lodash.trim
+/**
+ * @param {string} string - String to trim
+ * @param {string} [chars] - Characters to trim (defaults to whitespace)
+ * @returns {string}
+ */
 function trim(string, chars) {
   if (string === null || string === undefined) {
-    return '';
+    return ''
   }
 
-  string = String(string);
+  string = String(string)
 
   if (!chars && String.prototype.trim) {
-    return string.trim();
+    return string.trim()
   }
 
   if (!chars) {
     // Default characters to trim (whitespace)
-    chars = ' \t\n\r\f\v\u00a0\u1680\u2000\u200a\u2028\u2029\u202f\u205f\u3000\ufeff';
+    chars = ' \t\n\r\f\v\u00a0\u1680\u2000\u200a\u2028\u2029\u202f\u205f\u3000\ufeff'
   }
 
   // Check cache first
@@ -78,7 +132,7 @@ function trim(string, chars) {
 
   // Reset lastIndex for global regex reuse
   pattern.lastIndex = 0
-  return string.replace(pattern, '');
+  return string.replace(pattern, '')
 }
 
 module.exports = {
@@ -94,10 +148,10 @@ module.exports = {
   camelCase,
   kebabCase,
   capitalize,
-  split,
+  split: (str, sep) => String(str).split(sep),
   map,
   mapValues,
-  assign,
+  assign: Object.assign,
   set,
   cloneDeep,
 }

package/src/utils/parsing/cloudformationSchema.js

@@ -1,8 +1,5 @@
 const YAML = require('js-yaml');
-const includes = require('lodash.includes');
-const isString = require('lodash.isstring');
-const flatten = require('lodash.flatten');
-const map = require('lodash.map');
+const { isString } = require('../lodash')
 
 const functionNames = [
   // Standard intrinsic functions
@@ -36,7 +33,7 @@ const functionNames = [
 ];
 
 const yamlType = (name, kind) => {
-  const functionName = includes(['Ref', 'Condition'], name) ? name : `Fn::${name}`;
+  const functionName = ['Ref', 'Condition'].includes(name) ? name : `Fn::${name}`;
   return new YAML.Type(`!${name}`, {
     kind,
     construct: data => {
@@ -61,11 +58,9 @@ const yamlType = (name, kind) => {
 };
 
 const createSchema = () => {
-  const types = flatten(
-    map(functionNames, functionName =>
-      map(['mapping', 'scalar', 'sequence'], kind => yamlType(functionName, kind))
-    )
-  );
+  const types = functionNames.flatMap(functionName =>
+    ['mapping', 'scalar', 'sequence'].map(kind => yamlType(functionName, kind))
+  )
   return YAML.Schema.create(YAML.DEFAULT_SAFE_SCHEMA, types);
 };