nanos-lint 2.4.0 → 2.5.0

package/dist/{cli-kmHD4epr.js → cli-BVXk8XmH.js}

@@ -823,6 +823,19 @@ function loadConfigFile(filePath) {
 	return parseJsonc(fs.readFileSync(filePath, "utf-8"));
 }
 /**
+* Removes trailing `/` characters from a path-like string.
+*
+* Implemented with a scan instead of a `\/+$` regular expression: on inputs made
+* of many slashes that do not end in a slash, a backtracking engine retries the
+* repetition at every offset, which is quadratic in the input length
+* (CodeQL: js/polynomial-redos).
+*/
+function stripTrailingSlashes(value) {
+	let end = value.length;
+	while (end > 0 && value.charCodeAt(end - 1) === 47) end -= 1;
+	return end === value.length ? value : value.slice(0, end);
+}
+/**
 * Merges a base nanos configuration with a workspace override configuration.
 * Guarantees that the nanos definitions directory is included in workspace.library,
 * and standardizes paths for LuaLS.
@@ -869,12 +882,12 @@ function mergeConfigs(base, override = {}, definitionsDir = getDefinitionsDir(),
 		for (const pat of normalizedCliIgnore) {
 			excludePatterns.add(pat);
 			if (!pat.includes("*") && !pat.includes("?") && !pat.endsWith(".lua")) {
-				const dirPat = pat.replace(/\/+$/, "");
+				const dirPat = stripTrailingSlashes(pat);
 				excludePatterns.add(`${dirPat}/**`);
 			}
 		}
 		mergedFilesExclude = Array.from(excludePatterns);
-		const cliDirs = normalizedCliIgnore.filter((p) => !p.includes("*") && !p.includes("?") && !p.endsWith(".lua")).map((p) => p.replace(/\/+$/, ""));
+		const cliDirs = normalizedCliIgnore.filter((p) => !p.includes("*") && !p.includes("?") && !p.endsWith(".lua")).map((p) => stripTrailingSlashes(p));
 		mergedIgnoreDir = Array.from(/* @__PURE__ */ new Set([
 			...defaultIgnore,
 			...baseIgnore,
@@ -939,7 +952,7 @@ function resolveWorkspaceConfig(workspacePath, customConfigPath, options) {
 	const hasCliIgnore = Boolean(options?.ignore && options.ignore.length > 0);
 	let cliIgnore = options?.ignore;
 	if (hasCliIgnore && cliIgnore) {
-		const normWs = workspacePath.replace(/\\/g, "/").replace(/^\.\//, "").replace(/\/+$/, "");
+		const normWs = stripTrailingSlashes(workspacePath.replace(/\\/g, "/").replace(/^\.\//, ""));
 		const expanded = [];
 		for (const pat of cliIgnore) {
 			expanded.push(pat);
@@ -1002,6 +1015,39 @@ const execFileAsync = promisify(execFile);
 const FALLBACK_LUALS_VERSION = "3.19.1";
 const DEFAULT_LUALS_VERSION = "latest";
 /**
+* Characters accepted in a LuaLS version/tag. Only ASCII letters, digits, dots,
+* dashes and underscores are allowed, so a version can never contain a path
+* separator, a drive letter or a traversal segment.
+*/
+const SAFE_VERSION_CHARS = new Map([..."0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz._-"].map((ch) => [ch, ch]));
+const MAX_VERSION_LENGTH = 64;
+/**
+* Validates a LuaLS version/tag and rebuilds it from the allow-list above.
+*
+* Version strings originate from untrusted sources: the GitHub releases API
+* response and user supplied `--luals-version` arguments. They are interpolated
+* into cache directory paths, download URLs, and the path of the binary that is
+* eventually executed, so they must be constrained to a single safe path
+* segment. Rebuilding the value character by character guarantees the returned
+* string only ever contains allow-listed characters (CodeQL: js/command-line-injection).
+*
+* @returns the normalized version (a single leading `v` is dropped), or `null`
+*          when the input cannot be used as a version tag.
+*/
+function sanitizeLuaLSVersion(raw) {
+	const trimmed = raw.trim();
+	if (trimmed.length === 0 || trimmed.length > MAX_VERSION_LENGTH) return null;
+	let version = "";
+	for (const ch of trimmed) {
+		const allowed = SAFE_VERSION_CHARS.get(ch);
+		if (allowed === void 0) return null;
+		version += allowed;
+	}
+	if (version.charCodeAt(0) === 118) version = version.slice(1);
+	const first = version.charCodeAt(0);
+	return first >= 48 && first <= 57 || first >= 65 && first <= 90 || first >= 97 && first <= 122 ? version : null;
+}
+/**
 * Escapes single quotes for safe PowerShell single-quoted string interpolation.
 */
 function escapePowerShellSingleQuote(str) {
@@ -1020,17 +1066,22 @@ async function resolveLatestLuaLSVersion() {
 		});
 		if (res.ok) {
 			const data = await res.json();
-			if (data.tag_name) return data.tag_name.replace(/^v/, "");
+			const version = typeof data.tag_name === "string" ? sanitizeLuaLSVersion(data.tag_name) : null;
+			if (version) return version;
 		}
 	} catch {}
 	return FALLBACK_LUALS_VERSION;
 }
 /**
 * Resolves a version string ("latest" -> actual tag).
+*
+* @throws when an explicitly requested version is not a valid tag.
 */
 async function resolveLuaLSVersion(version) {
 	if (!version || version === "latest") return await resolveLatestLuaLSVersion();
-	return version.replace(/^v/, "");
+	const sanitized = sanitizeLuaLSVersion(version);
+	if (!sanitized) throw new Error(`Invalid LuaLS version: "${version}". Expected a release tag such as "3.19.1", or "latest".`);
+	return sanitized;
 }
 function getPlatformInfo(version = FALLBACK_LUALS_VERSION) {
 	const platform = process.platform;
@@ -4620,6 +4671,6 @@ if (isDirectExecution()) runCLI().then((code) => {
 	process.exit(1);
 });
 //#endregion
-export { mergeConfigs as A, resolveLuaLSVersion as C, getPackageRoot as D, getDefinitionsDir as E, resolveWorkspaceConfig as M, stripJsonComments as N, initWorkspace as O, fileUriToPath as P, resolveLuaLSBinary as S, getDefaultTemplatePath as T, escapePowerShellSingleQuote as _, formatGitHubAnnotations as a, isBinaryValid as b, formatReport as c, pluralize as d, shouldEnableColor as f, downloadAndExtractLuaLS as g, countCheckedFiles as h, runCLI as i, parseJsonc as j, loadConfigFile as k, formatSeverityBadge as l, FALLBACK_LUALS_VERSION as m, createProgram as n, formatPretty as o, DEFAULT_LUALS_VERSION as p, isDirectExecution as r, formatProblemSummary as s, collectIgnorePatterns as t, getColors as u, getCacheDir as v, runLuaLSCheck as w, resolveLatestLuaLSVersion as x, getPlatformInfo as y };
+export { loadConfigFile as A, resolveLuaLSVersion as C, getDefinitionsDir as D, getDefaultTemplatePath as E, stripTrailingSlashes as F, fileUriToPath as I, parseJsonc as M, resolveWorkspaceConfig as N, getPackageRoot as O, stripJsonComments as P, resolveLuaLSBinary as S, sanitizeLuaLSVersion as T, escapePowerShellSingleQuote as _, formatGitHubAnnotations as a, isBinaryValid as b, formatReport as c, pluralize as d, shouldEnableColor as f, downloadAndExtractLuaLS as g, countCheckedFiles as h, runCLI as i, mergeConfigs as j, initWorkspace as k, formatSeverityBadge as l, FALLBACK_LUALS_VERSION as m, createProgram as n, formatPretty as o, DEFAULT_LUALS_VERSION as p, isDirectExecution as r, formatProblemSummary as s, collectIgnorePatterns as t, getColors as u, getCacheDir as v, runLuaLSCheck as w, resolveLatestLuaLSVersion as x, getPlatformInfo as y };
 
-//# sourceMappingURL=cli-kmHD4epr.js.map
+//# sourceMappingURL=cli-BVXk8XmH.js.map