content-grade 1.0.7 → 1.0.9

package/bin/content-grade.js

@@ -90,6 +90,17 @@ const MG = '\x1b[35m';
 const BL = '\x1b[34m';
 const WH = '\x1b[97m';
 
+// ── Input sanitization ────────────────────────────────────────────────────────
+
+// Reject null bytes (path traversal vector) and trim surrounding whitespace.
+// Returns sanitized string, or null if the input is invalid.
+function sanitizeFilePath(p) {
+  if (typeof p !== 'string') return null;
+  if (p.includes('\0')) return null;
+  const trimmed = p.trim();
+  return trimmed || null;
+}
+
 // ── Helpers ───────────────────────────────────────────────────────────────────
 
 function ok(msg)   { console.log(`  ${GN}✓${R} ${msg}`); }
@@ -257,6 +268,15 @@ async function cmdAnalyze(filePath) {
     process.exit(2);
   }
 
+  const safeFilePath = sanitizeFilePath(filePath);
+  if (!safeFilePath) {
+    blank();
+    fail(`Invalid file path.`);
+    blank();
+    process.exit(2);
+  }
+  filePath = safeFilePath;
+
   const absPath = resolve(process.cwd(), filePath);
   if (!existsSync(absPath)) {
     blank();
@@ -856,6 +876,15 @@ async function cmdBatch(dirPath) {
     process.exit(2);
   }
 
+  const safeDirPath = sanitizeFilePath(dirPath);
+  if (!safeDirPath) {
+    blank();
+    fail(`Invalid directory path.`);
+    blank();
+    process.exit(2);
+  }
+  dirPath = safeDirPath;
+
   const absDir = resolve(process.cwd(), dirPath);
   if (!existsSync(absDir)) {
     blank();
@@ -1439,9 +1468,15 @@ function fetchUrl(url) {
   return new Promise((resolve, reject) => {
     const get = url.startsWith('https') ? httpsGet : httpGet;
     const req = get(url, { headers: { 'User-Agent': 'ContentGrade/1.0 (+https://github.com/content-grade/Content-Grade)' }, timeout: 15000 }, (res) => {
-      // Follow one redirect
+      // Follow one redirect — validate location is http/https before following
       if ((res.statusCode === 301 || res.statusCode === 302) && res.headers.location) {
-        fetchUrl(res.headers.location).then(resolve).catch(reject);
+        const loc = res.headers.location;
+        if (!/^https?:\/\//i.test(loc)) {
+          reject(new Error(`Redirect to non-HTTP location rejected: ${loc.slice(0, 80)}`));
+          res.resume();
+          return;
+        }
+        fetchUrl(loc).then(resolve).catch(reject);
         res.resume();
         return;
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "content-grade",
-  "version": "1.0.7",
+  "version": "1.0.9",
   "description": "AI-powered content analysis CLI. Score any blog post, landing page, or ad copy in under 30 seconds — runs on Claude CLI, no API key needed.",
   "type": "module",
   "bin": {