git-watchtower 1.11.0 → 1.11.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "git-watchtower",
-  "version": "1.11.0",
+  "version": "1.11.2",
   "description": "Terminal-based Git branch monitor with activity sparklines and optional dev server with live reload",
   "main": "bin/git-watchtower.js",
   "bin": {

package/src/utils/browser.js

@@ -5,6 +5,22 @@
 
 const { execFile } = require('child_process');
 
+/**
+ * Validate that a string is a safe URL to pass to OS open commands.
+ * Rejects URLs containing shell metacharacters that could lead to
+ * command injection when passed through cmd.exe on Windows.
+ * @param {string} url
+ * @returns {boolean}
+ */
+function isSafeUrl(url) {
+  if (!url || typeof url !== 'string') return false;
+  // Must start with http://, https://, or file://
+  if (!/^https?:\/\/|^file:\/\//i.test(url)) return false;
+  // Reject shell metacharacters that cmd.exe would interpret
+  if (/[&|<>^"!%]/.test(url)) return false;
+  return true;
+}
+
 /**
  * Open a URL in the user's default browser.
  * Cross-platform: macOS (open), Windows (start), Linux (xdg-open).
@@ -13,6 +29,13 @@ const { execFile } = require('child_process');
  * @param {function} [onError] - Optional error callback (receives Error)
  */
 function openInBrowser(url, onError) {
+  if (!isSafeUrl(url)) {
+    if (onError) {
+      onError(new Error(`Refusing to open unsafe URL: ${url}`));
+    }
+    return;
+  }
+
   const platform = process.platform;
   let command;
   let args;
@@ -22,7 +45,7 @@ function openInBrowser(url, onError) {
     args = [url];
   } else if (platform === 'win32') {
     // On Windows, 'start' is a shell built-in, so we must use cmd.exe.
-    // The URL is passed as a separate argument, not interpolated into a string.
+    // URL is validated above to reject shell metacharacters.
     command = 'cmd.exe';
     args = ['/c', 'start', '', url];
   } else {
@@ -37,4 +60,4 @@ function openInBrowser(url, onError) {
   });
 }
 
-module.exports = { openInBrowser };
+module.exports = { openInBrowser, isSafeUrl };

package/src/utils/version-check.js

@@ -8,17 +8,33 @@ const { version: currentVersion } = require('../../package.json');
 
 /**
  * Compare two semver version strings
+ * Handles missing segments (treated as 0), >3-part versions,
+ * and prerelease suffixes (e.g. 1.8.0-beta.1 < 1.8.0).
  * @param {string} a - First version (e.g. '1.8.0')
  * @param {string} b - Second version (e.g. '1.7.0')
  * @returns {number} 1 if a > b, -1 if a < b, 0 if equal
  */
 function compareVersions(a, b) {
-  const pa = a.split('.').map(Number);
-  const pb = b.split('.').map(Number);
-  for (let i = 0; i < 3; i++) {
-    if (pa[i] > pb[i]) return 1;
-    if (pa[i] < pb[i]) return -1;
+  // Split off prerelease suffix (e.g. '1.8.0-beta.1' → core='1.8.0', pre='beta.1')
+  const [coreA, preA] = a.split('-', 2);
+  const [coreB, preB] = b.split('-', 2);
+
+  const pa = coreA.split('.').map(Number);
+  const pb = coreB.split('.').map(Number);
+  const len = Math.max(pa.length, pb.length);
+
+  for (let i = 0; i < len; i++) {
+    const na = pa[i] || 0;
+    const nb = pb[i] || 0;
+    if (na > nb) return 1;
+    if (na < nb) return -1;
   }
+
+  // Core versions are equal — check prerelease.
+  // A version with a prerelease tag is less than one without (semver §11).
+  if (preA && !preB) return -1;
+  if (!preA && preB) return 1;
+
   return 0;
 }