extension-create 4.1.18 → 4.1.19

package/README.md

@@ -47,7 +47,7 @@ Creates a new extension project with the specified configuration.
 
 - `projectName` (string, required) - The name of your extension project
 - `options` (object) - Configuration options
-  - `template` (string, optional) - Template name or URL. Defaults to `'javascript'` (`init` is an alias)
+  - `template` (string, optional) - Template name or URL. Defaults to `'javascript'` (`init` is an alias). A URL must use `https://`. A plain `http://` URL, and an `http://` value in `EXTENSION_CREATE_TEMPLATE_URL`, fails unless `EXTENSION_ALLOW_HTTP_TEMPLATE=true` is set
   - `install` (boolean, optional) - Whether to install dependencies after scaffolding. Defaults to `false` so project creation is fast and users see the familiar `npm install` output on their own.
   - `cliVersion` (string, optional) - CLI version for package.json
 

package/dist/lib/messages.d.ts

@@ -11,6 +11,7 @@ export declare function writingTypeDefinitionsError(error: unknown): string;
 export declare function installingFromTemplate(projectName: string, templateName: string): string;
 export declare function usingTemplate(templateName: string, source: string): string;
 export declare function installingFromTemplateError(template: string, error: unknown): string;
+export declare function templateUrlNotHttps(url: string): string;
 export declare function templateFetchTimedOut(templateName: string, ms: number): string;
 export declare function templateNotFoundInCatalog(templateName: string, error?: unknown): string;
 export declare function templateDownloadFailed(templateName: string, error: unknown): string;

package/dist/module.cjs

@@ -252,6 +252,9 @@ function usingTemplate(templateName, source) {
 function installingFromTemplateError(template, error) {
     return `${prefix('error')} Couldn't find the template ${external_pintor_default().blue(template)}.\n${fmt.label('REASON')} ${fmt.val(fmt.truncate(String(error)))}\n${external_pintor_default().red('Choose a template name from')} ${external_pintor_default().blue('extension create --help')}${external_pintor_default().red(', or pass a GitHub URL.')}`;
 }
+function templateUrlNotHttps(url) {
+    return `${prefix('error')} Can't download a template over plain HTTP.\n${fmt.label('GOT')} ${fmt.val(fmt.truncate(url, 120))}\n${external_pintor_default().red('- Use the')} ${external_pintor_default().blue('https://')} ${external_pintor_default().red('address of the template.')}\n${external_pintor_default().red('- Set')} ${external_pintor_default().blue('EXTENSION_ALLOW_HTTP_TEMPLATE=true')} ${external_pintor_default().red('to allow plain HTTP.')}`;
+}
 function templateFetchTimedOut(templateName, ms) {
     return `${prefix('error')} Couldn't fetch the template ${external_pintor_default().blue(templateName)} within ${Math.round(ms / 1000)}s.\n${external_pintor_default().red('- Check your network connection.')}\n${external_pintor_default().red('- Set')} ${external_pintor_default().blue('EXTENSION_CREATE_TIMEOUT_MS')} ${external_pintor_default().red('to allow more time.')}`;
 }
@@ -655,6 +658,29 @@ class TemplateNotFoundError extends Error {
         if (cause) this.cause = cause;
     }
 }
+class InsecureTemplateUrlError extends Error {
+    constructor(url){
+        super(`template URL is not https: ${url}`), _define_property(this, "url", void 0);
+        this.name = 'InsecureTemplateUrlError';
+        this.url = url;
+    }
+}
+function isRefusedHttpTemplateUrl(url) {
+    if ('true' === process.env.EXTENSION_ALLOW_HTTP_TEMPLATE) return false;
+    return /^http:\/\//i.test(url);
+}
+function refuseHttpRedirect(options) {
+    const target = String(options.href || `${options.protocol || ''}//`);
+    if (isRefusedHttpTemplateUrl(target)) throw new InsecureTemplateUrlError(target);
+}
+function findInsecureTemplateUrlError(error) {
+    let current = error;
+    for(let depth = 0; current && depth < 4; depth++){
+        if (current instanceof InsecureTemplateUrlError) return current;
+        current = current.cause;
+    }
+    return null;
+}
 class TemplateDownloadError extends Error {
     constructor(templateName, cause){
         const msg = cause?.message ?? String(cause);
@@ -674,11 +700,13 @@ async function downloadArchive(url, timeoutMs, attempts = 2) {
             timeout: timeoutMs,
             headers: {
                 'User-Agent': 'extension-create'
-            }
+            },
+            beforeRedirect: refuseHttpRedirect
         });
         return Buffer.from(data);
     } catch (error) {
         lastError = error;
+        if (findInsecureTemplateUrlError(error)) break;
         const status = error?.response?.status;
         const retriable = void 0 === status || 429 === status || status >= 500;
         if (attempt >= attempts || !retriable) break;
@@ -712,6 +740,7 @@ async function extractExamplesTemplateFromZip(zipBuffer, templateName, projectPa
 async function importFromExamplesCatalog(templateName, projectPath) {
     const ref = process.env.EXTENSION_CREATE_TEMPLATE_REF || DEFAULT_TEMPLATES_REF;
     const overrideUrl = process.env.EXTENSION_CREATE_TEMPLATE_URL || void 0;
+    if (overrideUrl && isRefusedHttpTemplateUrl(overrideUrl)) throw new InsecureTemplateUrlError(overrideUrl);
     const urls = resolveCatalogUrls(ref, overrideUrl);
     let buffer;
     let source;
@@ -721,6 +750,8 @@ async function importFromExamplesCatalog(templateName, projectPath) {
         source = candidate;
         break;
     } catch (error) {
+        const insecure = findInsecureTemplateUrlError(error);
+        if (insecure) throw insecure;
         lastError = error;
     }
     if (!buffer || !source) throw new TemplateDownloadError(templateName, lastError);
@@ -884,6 +915,7 @@ async function importExternalTemplate(projectPath, projectName, template, logger
     } catch  {}
     const ownerGitignore = dirExistedBeforeImport ? await readOwnerGitignore(projectPath) : null;
     try {
+        if (isRefusedHttpTemplateUrl(template)) throw new InsecureTemplateUrlError(template);
         await promises_namespaceObject.mkdir(projectPath, {
             recursive: true
         });
@@ -931,7 +963,8 @@ async function importExternalTemplate(projectPath, projectName, template, logger
             const { data, headers } = await external_axios_default().get(template, {
                 responseType: 'arraybuffer',
                 maxRedirects: 5,
-                timeout: NETWORK_TIMEOUT_MS
+                timeout: NETWORK_TIMEOUT_MS,
+                beforeRedirect: refuseHttpRedirect
             });
             const contentType = String(headers?.['content-type'] || '');
             const looksZip = /zip|octet-stream/i.test(contentType) || template.toLowerCase().endsWith('.zip');
@@ -974,7 +1007,9 @@ async function importExternalTemplate(projectPath, projectName, template, logger
                 return fallback;
             }
         }
-        if (error instanceof TemplateNotFoundError) logger.error(templateNotFoundInCatalog(templateName, error.cause));
+        const insecureUrl = findInsecureTemplateUrlError(error);
+        if (insecureUrl) logger.error(templateUrlNotHttps(insecureUrl.url));
+        else if (error instanceof TemplateNotFoundError) logger.error(templateNotFoundInCatalog(templateName, error.cause));
         else if (error instanceof TemplateDownloadError) logger.error(templateDownloadFailed(templateName, error));
         else logger.error(installingFromTemplateError(templateName, error));
         await cleanupFailedImport(projectPath, ownsProjectDir, preExistingEntries);

package/dist/steps/import-external-template.d.ts

@@ -14,6 +14,15 @@ export declare class TemplateNotFoundError extends Error {
     readonly templateName: string;
     constructor(templateName: string, cause?: unknown);
 }
+export declare class InsecureTemplateUrlError extends Error {
+    readonly url: string;
+    constructor(url: string);
+}
+export declare function isRefusedHttpTemplateUrl(url: string): boolean;
+export declare function refuseHttpRedirect(options: {
+    protocol?: string;
+    href?: string;
+}): void;
 export declare class TemplateDownloadError extends Error {
     readonly templateName: string;
     constructor(templateName: string, cause: unknown);

package/dist/test-template-javascript/.extension-create.json

@@ -1,5 +1,5 @@
 {
-  "createdWith": "extension-create@4.1.17",
+  "createdWith": "extension-create@4.1.18",
   "template": "typescript",
   "source": "https://codeload.github.com/extension-js/examples/zip/e552f6db6f2862093ba9d7026e0d376f002d95cc",
   "ref": "e552f6db6f2862093ba9d7026e0d376f002d95cc"

package/dist/test-template-javascript/STORE.md

@@ -9,7 +9,7 @@ Packaging your extension is local and free. Submitting the result to a
 store is what [extension.dev](https://docs.extension.dev/publish/overview?utm_source=store-md)
 does, and it sponsors Extension.js.
 
-Last updated: 2026-09-14
+Last updated: 2026-09-15
 
 ## Listing
 

package/dist/test-template-javascript/package.json

@@ -8,7 +8,7 @@
   "devDependencies": {
     "@types/chrome": "^0.0.287",
     "typescript": "7.0.2",
-    "extension": "^4.1.17"
+    "extension": "^4.1.18"
   },
   "scripts": {
     "dev": "extension dev",

package/package.json

@@ -25,7 +25,7 @@
     "templates"
   ],
   "name": "extension-create",
-  "version": "4.1.18",
+  "version": "4.1.19",
   "description": "The standalone extension creation engine for Extension.js",
   "author": {
     "name": "Cezar Augusto",