openclaw-plugin-vt-sentinel 0.8.3 → 0.8.5

package/dist/index.js

@@ -145,11 +145,15 @@ function generateUpdateCommands(opts) {
         return lines.join('\n');
     }
     const stateDir = opts.stateDir;
-    // Escape double quotes in paths to prevent shell injection via OPENCLAW_STATE_DIR
-    const escapeForShell = (s) => s.replace(/"/g, '\\"');
     const extDir = path.join(stateDir, 'extensions', PACKAGE_NAME);
-    const quotedExtDir = `"${escapeForShell(extDir)}"`;
     const configPath = path.join(stateDir, 'openclaw.json');
+    // Shell quoting helpers:
+    // Single-quote for bash (no expansion at all): handle embedded ' via '\''
+    const singleQuote = (s) => "'" + s.replace(/'/g, "'\\''") + "'";
+    // Double-quote for shell: escape \, ", $, ` (all chars bash expands inside "")
+    const doubleQuote = (s) => '"' + s.replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/\$/g, '\\$').replace(/`/g, '\\`') + '"';
+    // For JS string inside shell double-quoted node -e: escape \, ", ', $, `
+    const jsInShellDq = (s) => s.replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/'/g, "\\'").replace(/\$/g, '\\$').replace(/`/g, '\\`');
     const lines = [];
     lines.push(`Upgrade: v${opts.currentVersion} → v${opts.latestVersion}`);
     lines.push('');
@@ -167,15 +171,15 @@ function generateUpdateCommands(opts) {
     lines.push('In that case, replace step 2 with:');
     lines.push('');
     lines.push(`  2a. Remove the extension directory:`);
-    lines.push(`      rm -rf ${quotedExtDir}    (Linux/macOS)`);
-    lines.push(`      rmdir /s /q ${quotedExtDir.replace(/\//g, '\\\\')}   (Windows)`);
+    lines.push(`      rm -rf ${singleQuote(extDir)}    (Linux/macOS)`);
+    lines.push(`      rmdir /s /q ${doubleQuote(extDir.replace(/\//g, '\\\\'))}   (Windows)`);
     lines.push('');
     lines.push(`  2b. Back up and clean the stale install entry (preserves your config):`);
     // Generate a safe node -e script for config cleanup.
     // Only deletes plugins.installs (stale install metadata), NOT plugins.entries (user config with apiKey etc.).
     // Tries json5 parser first (likely available as openclaw dependency), falls back to JSON.parse.
-    const safeConfigPath = configPath.replace(/\\/g, '\\\\').replace(/'/g, "\\'").replace(/"/g, '\\"');
-    const cleanupScript = `node -e "const fs=require('fs'),p='${safeConfigPath}';try{const b=fs.readFileSync(p,'utf8');fs.writeFileSync(p+'.bak',b);const P=(()=>{try{return require('json5').parse}catch{return JSON.parse}})();const c=P(b);if(c.plugins&&c.plugins.installs){delete c.plugins.installs['${PACKAGE_NAME}'];}fs.writeFileSync(p,JSON.stringify(c,null,2));console.log('Config cleaned (backup: '+p+'.bak)')}catch(e){console.error('Failed: '+e.message+'. Manually remove ${PACKAGE_NAME} from plugins.installs in '+p);process.exit(1)}"`;
+    // All interpolated paths are escaped for shell double-quote context ($, `, \, ").
+    const cleanupScript = `node -e "const fs=require('fs'),p='${jsInShellDq(configPath)}';try{const b=fs.readFileSync(p,'utf8');fs.writeFileSync(p+'.bak',b);const P=(()=>{try{return require('json5').parse}catch{return JSON.parse}})();const c=P(b);if(c.plugins&&c.plugins.installs){delete c.plugins.installs['${PACKAGE_NAME}'];}fs.writeFileSync(p,JSON.stringify(c,null,2));console.log('Config cleaned (backup: '+p+'.bak)')}catch(e){console.error('Failed: '+e.message+'. Manually remove ${PACKAGE_NAME} from plugins.installs in '+p);process.exit(1)}"`;
     lines.push(`      ${cleanupScript}`);
     lines.push('');
     lines.push(`  2c. Reinstall:`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openclaw-plugin-vt-sentinel",
-  "version": "0.8.3",
+  "version": "0.8.5",
   "description": "VirusTotal Sentinel for OpenClaw - Malware detection and AI-powered code analysis",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",