rastack 0.0.40 → 0.0.41

package/CHANGELOG.md

@@ -2,6 +2,8 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+### [0.0.41](https://github.com/theserverkid/reactapistack/compare/v0.0.40...v0.0.41) (2026-07-12)
+
 ### [0.0.40](https://github.com/theserverkid/reactapistack/compare/v0.0.39...v0.0.40) (2026-07-12)
 
 

package/dist/rastack-update.js

@@ -56,6 +56,12 @@ const path = __importStar(require("path"));
 const update_1 = require("./update");
 /** The npm executable for this platform (`npm.cmd` on Windows, else `npm`). */
 const NPM = (0, update_1.npmBinary)();
+/**
+ * Whether to launch npm through a shell. Required on Windows, where a bare
+ * `.cmd` spawn is rejected with `EINVAL` since the Node CVE-2024-27980 fix;
+ * false on POSIX so the direct spawn stays injection-free.
+ */
+const NPM_SHELL = (0, update_1.npmSpawnShell)();
 /** The installed rastack package directory (…/rastack), one up from dist/. */
 const PKG_DIR = path.join(__dirname, "..");
 const PKG_JSON = path.join(PKG_DIR, "package.json");
@@ -73,6 +79,7 @@ function npmCapture(args) {
     try {
         return (0, child_process_1.execFileSync)(NPM, args, {
             stdio: ["ignore", "pipe", "pipe"],
+            shell: NPM_SHELL,
         })
             .toString()
             .trim();
@@ -118,10 +125,12 @@ function main(argv) {
     }
     console.log(`\n▸ Updating rastack (${current} → ${flags.version}) in ${prefix}\n`);
     try {
-        // Re-runs the developer's own npm to update this global package — no
-        // untrusted input, and execFileSync (no shell) avoids any injection.
+        // Re-runs the developer's own npm to update this global package. On Windows
+        // the `.cmd` shim is launched through a shell (EINVAL otherwise); the only
+        // caller-supplied token — the version — is sanitized in `parseUpdateFlags`,
+        // and every other arg is a fixed literal, so nothing injectable reaches it.
         // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process
-        (0, child_process_1.execFileSync)(NPM, args, { stdio: "inherit", env });
+        (0, child_process_1.execFileSync)(NPM, args, { stdio: "inherit", env, shell: NPM_SHELL });
     }
     catch (err) {
         console.error(`\n  ✗ npm failed to update rastack. Re-run for detail:\n    npm install -g ${(0, update_1.npmInstallArgs)(flags.version)[2]}\n    ${err.message}`);

package/dist/update.d.ts

@@ -23,14 +23,35 @@ export interface UpdateFlags {
  * 0.0.40`). Unknown values default to `latest`.
  */
 export declare function parseUpdateFlags(argv: string[]): UpdateFlags;
+/**
+ * Constrain the update target to a safe npm version or dist-tag. The Windows
+ * update path runs npm through a shell (see `npmSpawnShell`), so the target —
+ * the one caller-supplied token that reaches the command line — must not be
+ * able to carry shell metacharacters. A valid npm spec starts alphanumeric and
+ * uses only `A-Za-z0-9._-` (e.g. `latest`, `next`, `0.0.40`, `1.2.3-beta.1`);
+ * anything else falls back to `latest`.
+ */
+export declare function sanitizeVersion(version: string | undefined): string;
 /**
  * The npm executable to spawn for a platform. On Windows npm is a `.cmd` shim,
  * not a real executable, so `execFile("npm", …)` (no shell) fails with
  * `spawnSync npm ENOENT` — the direct-spawn path only resolves real binaries,
  * never `PATHEXT` scripts. Spawn `npm.cmd` there; POSIX keeps plain `npm`.
  * (`aws` is unaffected — it installs as `aws.exe`, a real executable.)
+ *
+ * The `.cmd` must still be launched through a shell — see `npmSpawnShell`.
  */
 export declare function npmBinary(platform?: string): string;
+/**
+ * Whether npm must be spawned through a shell on this platform. Since the Node
+ * fix for CVE-2024-27980 (18.20.2 / 20.12.2 / 21.7.2), spawning a `.cmd` shim
+ * like `npm.cmd` *without* a shell is rejected with `spawnSync npm.cmd EINVAL`
+ * — the very failure a Windows/PowerShell `rastack update` hits. cmd.exe knows
+ * how to run a `.cmd`, so Windows spawns through the shell; POSIX keeps the
+ * direct, shell-free spawn (npm is a real script resolved on PATH there, and no
+ * shell means no injection surface).
+ */
+export declare function npmSpawnShell(platform?: string): boolean;
 /** The npm package spec to install for a target version. */
 export declare function installSpec(version: string): string;
 /** The `npm <args>` (after the `npm` binary) that installs the target globally. */

package/dist/update.js

@@ -12,7 +12,9 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.parseUpdateFlags = parseUpdateFlags;
+exports.sanitizeVersion = sanitizeVersion;
 exports.npmBinary = npmBinary;
+exports.npmSpawnShell = npmSpawnShell;
 exports.installSpec = installSpec;
 exports.npmInstallArgs = npmInstallArgs;
 exports.globalPrefixFromPackageDir = globalPrefixFromPackageDir;
@@ -39,26 +41,53 @@ function parseUpdateFlags(argv) {
                 break;
             case "--version":
             case "--to":
-                version = argv[++i] ?? "latest";
+                version = sanitizeVersion(argv[++i]);
                 break;
             default:
                 // A bare, non-flag token is taken as the target version.
                 if (!a.startsWith("-"))
-                    version = a;
+                    version = sanitizeVersion(a);
         }
     }
     return { version, check, dryRun };
 }
+/**
+ * Constrain the update target to a safe npm version or dist-tag. The Windows
+ * update path runs npm through a shell (see `npmSpawnShell`), so the target —
+ * the one caller-supplied token that reaches the command line — must not be
+ * able to carry shell metacharacters. A valid npm spec starts alphanumeric and
+ * uses only `A-Za-z0-9._-` (e.g. `latest`, `next`, `0.0.40`, `1.2.3-beta.1`);
+ * anything else falls back to `latest`.
+ */
+function sanitizeVersion(version) {
+    return version && /^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(version)
+        ? version
+        : "latest";
+}
 /**
  * The npm executable to spawn for a platform. On Windows npm is a `.cmd` shim,
  * not a real executable, so `execFile("npm", …)` (no shell) fails with
  * `spawnSync npm ENOENT` — the direct-spawn path only resolves real binaries,
  * never `PATHEXT` scripts. Spawn `npm.cmd` there; POSIX keeps plain `npm`.
  * (`aws` is unaffected — it installs as `aws.exe`, a real executable.)
+ *
+ * The `.cmd` must still be launched through a shell — see `npmSpawnShell`.
  */
 function npmBinary(platform = process.platform) {
     return platform === "win32" ? "npm.cmd" : "npm";
 }
+/**
+ * Whether npm must be spawned through a shell on this platform. Since the Node
+ * fix for CVE-2024-27980 (18.20.2 / 20.12.2 / 21.7.2), spawning a `.cmd` shim
+ * like `npm.cmd` *without* a shell is rejected with `spawnSync npm.cmd EINVAL`
+ * — the very failure a Windows/PowerShell `rastack update` hits. cmd.exe knows
+ * how to run a `.cmd`, so Windows spawns through the shell; POSIX keeps the
+ * direct, shell-free spawn (npm is a real script resolved on PATH there, and no
+ * shell means no injection surface).
+ */
+function npmSpawnShell(platform = process.platform) {
+    return platform === "win32";
+}
 /** The npm package spec to install for a target version. */
 function installSpec(version) {
     return !version || version === "latest" ? "rastack" : `rastack@${version}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rastack",
-  "version": "0.0.40",
+  "version": "0.0.41",
   "description": "",
   "main": "runtime.ts",
   "types": "runtime.ts",

package/src/rastack-update.ts

@@ -24,6 +24,7 @@ import {
   globalPrefixFromPackageDir,
   npmBinary,
   npmInstallArgs,
+  npmSpawnShell,
   parseUpdateFlags,
   updateAvailable,
 } from "./update";
@@ -31,6 +32,13 @@ import {
 /** The npm executable for this platform (`npm.cmd` on Windows, else `npm`). */
 const NPM = npmBinary();
 
+/**
+ * Whether to launch npm through a shell. Required on Windows, where a bare
+ * `.cmd` spawn is rejected with `EINVAL` since the Node CVE-2024-27980 fix;
+ * false on POSIX so the direct spawn stays injection-free.
+ */
+const NPM_SHELL = npmSpawnShell();
+
 /** The installed rastack package directory (…/rastack), one up from dist/. */
 const PKG_DIR = path.join(__dirname, "..");
 const PKG_JSON = path.join(PKG_DIR, "package.json");
@@ -49,6 +57,7 @@ function npmCapture(args: string[]): string | null {
   try {
     return execFileSync(NPM, args, {
       stdio: ["ignore", "pipe", "pipe"],
+      shell: NPM_SHELL,
     })
       .toString()
       .trim();
@@ -103,10 +112,12 @@ function main(argv: string[]): void {
     `\n▸ Updating rastack (${current} → ${flags.version}) in ${prefix}\n`,
   );
   try {
-    // Re-runs the developer's own npm to update this global package — no
-    // untrusted input, and execFileSync (no shell) avoids any injection.
+    // Re-runs the developer's own npm to update this global package. On Windows
+    // the `.cmd` shim is launched through a shell (EINVAL otherwise); the only
+    // caller-supplied token — the version — is sanitized in `parseUpdateFlags`,
+    // and every other arg is a fixed literal, so nothing injectable reaches it.
     // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process
-    execFileSync(NPM, args, { stdio: "inherit", env });
+    execFileSync(NPM, args, { stdio: "inherit", env, shell: NPM_SHELL });
   } catch (err) {
     console.error(
       `\n  ✗ npm failed to update rastack. Re-run for detail:\n    npm install -g ${npmInstallArgs(flags.version)[2]}\n    ${(err as Error).message}`,

package/src/update.ts

@@ -40,27 +40,56 @@ export function parseUpdateFlags(argv: string[]): UpdateFlags {
         break;
       case "--version":
       case "--to":
-        version = argv[++i] ?? "latest";
+        version = sanitizeVersion(argv[++i]);
         break;
       default:
         // A bare, non-flag token is taken as the target version.
-        if (!a.startsWith("-")) version = a;
+        if (!a.startsWith("-")) version = sanitizeVersion(a);
     }
   }
   return { version, check, dryRun };
 }
 
+/**
+ * Constrain the update target to a safe npm version or dist-tag. The Windows
+ * update path runs npm through a shell (see `npmSpawnShell`), so the target —
+ * the one caller-supplied token that reaches the command line — must not be
+ * able to carry shell metacharacters. A valid npm spec starts alphanumeric and
+ * uses only `A-Za-z0-9._-` (e.g. `latest`, `next`, `0.0.40`, `1.2.3-beta.1`);
+ * anything else falls back to `latest`.
+ */
+export function sanitizeVersion(version: string | undefined): string {
+  return version && /^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(version)
+    ? version
+    : "latest";
+}
+
 /**
  * The npm executable to spawn for a platform. On Windows npm is a `.cmd` shim,
  * not a real executable, so `execFile("npm", …)` (no shell) fails with
  * `spawnSync npm ENOENT` — the direct-spawn path only resolves real binaries,
  * never `PATHEXT` scripts. Spawn `npm.cmd` there; POSIX keeps plain `npm`.
  * (`aws` is unaffected — it installs as `aws.exe`, a real executable.)
+ *
+ * The `.cmd` must still be launched through a shell — see `npmSpawnShell`.
  */
 export function npmBinary(platform: string = process.platform): string {
   return platform === "win32" ? "npm.cmd" : "npm";
 }
 
+/**
+ * Whether npm must be spawned through a shell on this platform. Since the Node
+ * fix for CVE-2024-27980 (18.20.2 / 20.12.2 / 21.7.2), spawning a `.cmd` shim
+ * like `npm.cmd` *without* a shell is rejected with `spawnSync npm.cmd EINVAL`
+ * — the very failure a Windows/PowerShell `rastack update` hits. cmd.exe knows
+ * how to run a `.cmd`, so Windows spawns through the shell; POSIX keeps the
+ * direct, shell-free spawn (npm is a real script resolved on PATH there, and no
+ * shell means no injection surface).
+ */
+export function npmSpawnShell(platform: string = process.platform): boolean {
+  return platform === "win32";
+}
+
 /** The npm package spec to install for a target version. */
 export function installSpec(version: string): string {
   return !version || version === "latest" ? "rastack" : `rastack@${version}`;

package/test/update.spec.ts

@@ -4,7 +4,9 @@ import {
   installSpec,
   npmBinary,
   npmInstallArgs,
+  npmSpawnShell,
   parseUpdateFlags,
+  sanitizeVersion,
   updateAvailable,
 } from "../src/update";
 
@@ -56,6 +58,39 @@ describe("update — npm spec + args", () => {
     expect(npmBinary("linux")).toBe("npm");
     expect(npmBinary("darwin")).toBe("npm");
   });
+
+  it("runs npm through a shell only on Windows", () => {
+    // A `.cmd` shim can't be spawned directly since the Node CVE-2024-27980 fix
+    // (spawnSync npm.cmd EINVAL) — it must go through cmd.exe. POSIX spawns npm
+    // directly so there is no shell and no injection surface.
+    expect(npmSpawnShell("win32")).toBe(true);
+    expect(npmSpawnShell("linux")).toBe(false);
+    expect(npmSpawnShell("darwin")).toBe(false);
+  });
+});
+
+describe("update — version sanitization", () => {
+  it("keeps valid semver, dist-tags, and pinned versions", () => {
+    expect(sanitizeVersion("latest")).toBe("latest");
+    expect(sanitizeVersion("next")).toBe("next");
+    expect(sanitizeVersion("0.0.40")).toBe("0.0.40");
+    expect(sanitizeVersion("1.2.3-beta.1")).toBe("1.2.3-beta.1");
+  });
+
+  it("falls back to latest for empty or shell-unsafe input", () => {
+    expect(sanitizeVersion(undefined)).toBe("latest");
+    expect(sanitizeVersion("")).toBe("latest");
+    // Shell metacharacters must never reach the Windows shell-spawned npm.
+    expect(sanitizeVersion("0.0.40; rm -rf /")).toBe("latest");
+    expect(sanitizeVersion("$(whoami)")).toBe("latest");
+    expect(sanitizeVersion("a b")).toBe("latest");
+  });
+
+  it("is applied when parsing the bare positional and --version", () => {
+    expect(parseUpdateFlags(["0.0.40; evil"]).version).toBe("latest");
+    expect(parseUpdateFlags(["--version", "&& evil"]).version).toBe("latest");
+    expect(parseUpdateFlags(["0.0.40"]).version).toBe("0.0.40");
+  });
 });
 
 describe("update — global prefix derivation", () => {