crewly 1.20.194 → 1.20.195

package/dist/cli/backend/src/utils/security.d.ts

@@ -0,0 +1,196 @@
+/**
+ * Security Utilities
+ *
+ * Provides security-related validation and sanitization functions
+ * for protecting against common vulnerabilities like command injection,
+ * path traversal, and dangerous control sequences.
+ *
+ * @module security
+ */
+/**
+ * Result of a path validation check
+ */
+export interface PathValidationResult {
+    /** Whether the path is valid and safe */
+    isValid: boolean;
+    /** Error message if validation failed */
+    error?: string;
+    /** The normalized, absolute path if valid */
+    normalizedPath?: string;
+}
+/**
+ * Result of an input sanitization operation
+ */
+export interface SanitizationResult {
+    /** The sanitized string */
+    sanitized: string;
+    /** Whether any modifications were made */
+    wasModified: boolean;
+    /** List of removed or modified patterns */
+    removedPatterns?: string[];
+}
+/** Longest text {@link validateTerminalInput} accepts by default (characters). */
+export declare const TERMINAL_INPUT_MAX_LENGTH = 10000;
+/**
+ * Characters that are dangerous in shell commands and should be escaped or removed
+ * from user input that will be used in shell operations.
+ */
+export declare const SHELL_DANGEROUS_CHARS: readonly ["`", "$", "\\", "\"", "'", ";", "&", "|", ">", "<", "\n", "\r", "\0"];
+/**
+ * Dangerous control sequences that should not be allowed in terminal input.
+ * These can be used for terminal escape attacks or to manipulate terminal state.
+ */
+export declare const DANGEROUS_CONTROL_SEQUENCES: readonly ["\u001B", "\u0007", "\b", "", "›", "", "", "ž", "Ÿ"];
+/**
+ * Sanitizes a string for safe use in shell commands, specifically for
+ * git commit messages. Removes or escapes characters that could be used
+ * for command injection.
+ *
+ * @param input - The raw input string to sanitize
+ * @param options - Sanitization options
+ * @param options.maxLength - Maximum allowed length (default: 1000)
+ * @param options.allowNewlines - Whether to allow newlines (default: true for commit messages)
+ * @returns SanitizationResult with the sanitized string and metadata
+ *
+ * @example
+ * ```typescript
+ * const result = sanitizeForShell('Fix bug; rm -rf /');
+ * // result.sanitized === 'Fix bug rm -rf /'
+ * // result.wasModified === true
+ * ```
+ */
+export declare function sanitizeForShell(input: string, options?: {
+    maxLength?: number;
+    allowNewlines?: boolean;
+}): SanitizationResult;
+/**
+ * Sanitizes a git commit message by removing potentially dangerous characters
+ * while preserving the semantic content of the message.
+ *
+ * @param message - The raw commit message
+ * @param options - Sanitization options
+ * @param options.maxLength - Maximum message length (default: 5000)
+ * @returns SanitizationResult with the sanitized message
+ *
+ * @example
+ * ```typescript
+ * const result = sanitizeGitCommitMessage('feat: add feature $(whoami)');
+ * // result.sanitized === 'feat: add feature'
+ * ```
+ */
+export declare function sanitizeGitCommitMessage(message: string, options?: {
+    maxLength?: number;
+}): SanitizationResult;
+/**
+ * Validates that terminal input does not contain dangerous control sequences
+ * that could be used for terminal escape attacks.
+ *
+ * @param input - The terminal input to validate
+ * @param options - Validation options
+ * @param options.allowBasicFormatting - Allow basic ANSI formatting codes (colors, etc.)
+ * @param options.maxLength - Maximum input length (default: 10000)
+ * @returns Object with isValid flag and optional error message
+ *
+ * @example
+ * ```typescript
+ * const result = validateTerminalInput('echo hello');
+ * // result.isValid === true
+ *
+ * const result2 = validateTerminalInput('\x1b]0;malicious\x07');
+ * // result2.isValid === false
+ * // result2.error === 'Input contains Operating System Command sequences'
+ * ```
+ */
+export declare function validateTerminalInput(input: string, options?: {
+    allowBasicFormatting?: boolean;
+    maxLength?: number;
+}): {
+    isValid: boolean;
+    error?: string;
+};
+/**
+ * Sanitizes terminal input by removing dangerous control sequences while
+ * preserving safe content.
+ *
+ * @param input - The terminal input to sanitize
+ * @param options - Sanitization options
+ * @param options.preserveNewlines - Keep newline characters (default: true)
+ * @param options.maxLength - Maximum output length (default: 10000)
+ * @returns SanitizationResult with the sanitized input
+ *
+ * @example
+ * ```typescript
+ * const result = sanitizeTerminalInput('hello\x1b]0;title\x07world');
+ * // result.sanitized === 'helloworld'
+ * ```
+ */
+export declare function sanitizeTerminalInput(input: string, options?: {
+    preserveNewlines?: boolean;
+    maxLength?: number;
+}): SanitizationResult;
+/**
+ * Validates a file path to prevent path traversal attacks.
+ * Ensures the resolved path is within the allowed base directory.
+ *
+ * @param inputPath - The path to validate (can be relative or absolute)
+ * @param baseDirectory - The allowed base directory (must be absolute)
+ * @param options - Validation options
+ * @param options.allowSymlinks - Whether to allow symlinks (default: false for security)
+ * @returns PathValidationResult with validation status and normalized path
+ *
+ * @example
+ * ```typescript
+ * const result = validatePath('../../../etc/passwd', '/home/user/projects');
+ * // result.isValid === false
+ * // result.error === 'Path traversal detected'
+ *
+ * const result2 = validatePath('src/index.ts', '/home/user/projects');
+ * // result2.isValid === true
+ * // result2.normalizedPath === '/home/user/projects/src/index.ts'
+ * ```
+ */
+export declare function validatePath(inputPath: string, baseDirectory: string, options?: {
+    allowSymlinks?: boolean;
+}): PathValidationResult;
+/**
+ * Validates a project path ensuring it is within allowed directories
+ * (user's home directory or explicitly allowed paths).
+ *
+ * @param projectPath - The project path to validate
+ * @param allowedBasePaths - Additional allowed base paths (default: [os.homedir()])
+ * @returns PathValidationResult with validation status
+ *
+ * @example
+ * ```typescript
+ * const result = validateProjectPath('/home/user/projects/myapp');
+ * // result.isValid === true
+ *
+ * const result2 = validateProjectPath('/etc/passwd');
+ * // result2.isValid === false
+ * ```
+ */
+export declare function validateProjectPath(projectPath: string, allowedBasePaths?: string[]): PathValidationResult;
+/**
+ * Validates a session name to ensure it contains only safe characters.
+ *
+ * @param sessionName - The session name to validate
+ * @param options - Validation options
+ * @param options.maxLength - Maximum session name length (default: 100)
+ * @returns Object with isValid flag and optional error message
+ *
+ * @example
+ * ```typescript
+ * const result = validateSessionName('my-session_123');
+ * // result.isValid === true
+ *
+ * const result2 = validateSessionName('session; rm -rf /');
+ * // result2.isValid === false
+ * ```
+ */
+export declare function validateSessionName(sessionName: string, options?: {
+    maxLength?: number;
+}): {
+    isValid: boolean;
+    error?: string;
+};
+//# sourceMappingURL=security.d.ts.map

package/dist/cli/backend/src/utils/security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../../../../backend/src/utils/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACpC,yCAAyC;IACzC,OAAO,EAAE,OAAO,CAAC;IACjB,yCAAyC;IACzC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6CAA6C;IAC7C,cAAc,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IAClC,2BAA2B;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,0CAA0C;IAC1C,WAAW,EAAE,OAAO,CAAC;IACrB,2CAA2C;IAC3C,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,kFAAkF;AAClF,eAAO,MAAM,yBAAyB,QAAQ,CAAC;AAE/C;;;GAGG;AACH,eAAO,MAAM,qBAAqB,iFAcxB,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,2BAA2B,mEAU9B,CAAC;AAaX;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAC/B,KAAK,EAAE,MAAM,EACb,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,OAAO,CAAA;CAAO,GAC3D,kBAAkB,CA2FpB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wBAAwB,CACvC,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GAClC,kBAAkB,CAKpB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,qBAAqB,CACpC,KAAK,EAAE,MAAM,EACb,OAAO,GAAE;IAAE,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GAClE;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CA4EtC;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CACpC,KAAK,EAAE,MAAM,EACb,OAAO,GAAE;IAAE,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GAC9D,kBAAkB,CAwDpB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,YAAY,CAC3B,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EACrB,OAAO,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAO,GACvC,oBAAoB,CAgGtB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAClC,WAAW,EAAE,MAAM,EACnB,gBAAgB,CAAC,EAAE,MAAM,EAAE,GACzB,oBAAoB,CAiDtB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAClC,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GAClC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CA2BtC"}