fundamentum-cli 0.2.2 → 0.2.3

package/install.js

@@ -132,7 +132,7 @@ function psEscape(s) {
   return s.replace(/'/g, "''");
 }
 
-function spawnOrFail(cmd, args, label) {
+function spawnStdout(cmd, args, label) {
   const result = spawnSync(cmd, args, { stdio: "pipe" });
   if (result.error) {
     throw new Error(`${label}: ${result.error.message}`);
@@ -143,6 +143,11 @@ function spawnOrFail(cmd, args, label) {
       `${label} exited with code ${result.status}${stderr ? ": " + stderr : ""}`
     );
   }
+  return result.stdout.toString("utf8");
+}
+
+function spawnOrFail(cmd, args, label) {
+  spawnStdout(cmd, args, label);
 }
 
 function extract(buffer, archiveName, binDir) {
@@ -153,7 +158,13 @@ function extract(buffer, archiveName, binDir) {
   fs.writeFileSync(archivePath, buffer);
 
   try {
-    if (archiveName.endsWith(".zip")) {
+    // Validate the member list before extraction: a crafted archive can name
+    // members like ../../.bashrc, and the extractor would happily write them
+    // outside tmpDir. Reject such members up front so nothing leaves the dir.
+    const isZip = archiveName.endsWith(".zip");
+    validateMembers(listMembers(archivePath, isZip));
+
+    if (isZip) {
       if (process.platform === "win32") {
         spawnOrFail(
           "powershell",
@@ -191,6 +202,27 @@ function extract(buffer, archiveName, binDir) {
   }
 }
 
+function isPathEscape(name) {
+  return path.isAbsolute(name) || name.split(/[\\/]/).includes("..");
+}
+
+function listMembers(archivePath, isZip) {
+  const listing = isZip
+    ? spawnStdout("unzip", ["-Z1", archivePath], "unzip -Z1")
+    : spawnStdout("tar", ["-tzf", archivePath], "tar -tzf");
+  return listing.split(/\r?\n/).filter(Boolean);
+}
+
+function validateMembers(members) {
+  for (const member of members) {
+    if (isPathEscape(member)) {
+      throw new Error(
+        `Archive path escape detected: ${member} resolves outside the install directory`
+      );
+    }
+  }
+}
+
 async function main() {
   const pkg = JSON.parse(
     fs.readFileSync(path.join(__dirname, "package.json"), "utf8")
@@ -224,7 +256,11 @@ async function main() {
   console.log("fundamentum: installed successfully");
 }
 
-main().catch((err) => {
-  console.error(`fundamentum: installation failed: ${err.message}`);
-  process.exit(1);
-});
+if (require.main === module) {
+  main().catch((err) => {
+    console.error(`fundamentum: installation failed: ${err.message}`);
+    process.exit(1);
+  });
+}
+
+module.exports = { isPathEscape, listMembers, validateMembers };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fundamentum-cli",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "description": "Bootstrap and harden GitHub repos for OSS collaboration — community files, branch protection, security features, and starter workflows in one command.",
   "license": "MIT",
   "repository": {
@@ -15,7 +15,8 @@
     "fundamentum": "run.js"
   },
   "scripts": {
-    "postinstall": "node install.js"
+    "postinstall": "node install.js",
+    "test": "node --test install.test.js"
   },
   "os": [
     "linux",
@@ -57,10 +58,10 @@
     "bin/"
   ],
   "binaryChecksums": {
-    "fundamentum_0.2.2_darwin_amd64.tar.gz": "1aa96b7579d57ff6cdcc2b14903516a15d6d28a1b1e5903e19b50ef4f2e8ab8e",
-    "fundamentum_0.2.2_darwin_arm64.tar.gz": "b28f1af3db21d408b2f6121c9504bb7bd965f941cbaba24ee4ba14dac49b3636",
-    "fundamentum_0.2.2_linux_amd64.tar.gz": "f0c4bcd3cf6e951d3c5caccd4cbd76d146b56d32e43bcfbf1e3b4973910c4f57",
-    "fundamentum_0.2.2_linux_arm64.tar.gz": "f2aa4a1b73430c7108b0cb3a80bcfa2b887381eb9f6a93d09c9359c33d7afcc6",
-    "fundamentum_0.2.2_windows_amd64.zip": "28799b1f6136cfd25f426c04aab94f602152646f150c526de6632be2360580ac"
+    "fundamentum_0.2.3_darwin_amd64.tar.gz": "699818edde5867a634d60823cb21bb256f1553df51c913e908c8bb5959339b30",
+    "fundamentum_0.2.3_darwin_arm64.tar.gz": "f022a92f78c7908897bd18478438a4dfb10cc59dfd6eb2663a89d35dc8e78fb3",
+    "fundamentum_0.2.3_linux_amd64.tar.gz": "b84615a7a0fe5c13a71560bf2688d0256c08fb44548ff81930cc5fc700ff7aae",
+    "fundamentum_0.2.3_linux_arm64.tar.gz": "f045af85c5a2fdf9215a08fa033881fd2f0baa483d48bd68929fe07a864970c0",
+    "fundamentum_0.2.3_windows_amd64.zip": "b67e7e5366837def2f77dcbb5e25cfb370de0e608da5dc0424b40d244794ec5b"
   }
 }