rastack 0.0.40 → 0.0.42

package/src/rastack-bootstrap.ts

@@ -9,7 +9,8 @@
  *                     [--region <r>] [--prefix <p>]
  *                     [--reuse-oidc] [--print] [--yes]
  *
- * It deploys `deploy/cloudformation/bootstrap.yaml`, which creates:
+ * It deploys the `bootstrap.yaml` template bundled with the `rastack` package
+ * (resolved by `resolveDeployAsset`, so it works from any repo), which creates:
  *   • the S3 buckets that hold the Lambda placeholder + hosted templates, and
  *   • the GitHub OIDC provider + trust that lets CI assume a deploy role.
  * It then uploads the Lambda placeholder bundle to the artifacts bucket, so the
@@ -43,6 +44,7 @@ import {
   canPrompt,
   gitRemoteUrl,
   loadConfig,
+  resolveDeployAsset,
   stackOutput,
   uploadPlaceholder,
   withPrompt,
@@ -152,8 +154,9 @@ function printPlan(cfg: DeployConfig, reuseOidc: boolean): void {
   console.log(
     `\n  Bootstrap plan (${bootstrapStackName(cfg)} @ ${cfg.region})\n`,
   );
+  const template = resolveDeployAsset("bootstrap.yaml") ?? undefined;
   console.log("  ── Tier-0 bootstrap stack (bootstrap.yaml) ──");
-  console.log("\n  " + bootstrapStackCommand(cfg, reuseOidc) + "\n");
+  console.log("\n  " + bootstrapStackCommand(cfg, reuseOidc, template) + "\n");
   console.log(
     "  Then `rastack init` (or `rastack bootstrap` again) resolves this stack's\n" +
       "  ArtifactsBucket to create app backends. Nothing here is app-specific.\n",
@@ -166,8 +169,16 @@ function printPlan(cfg: DeployConfig, reuseOidc: boolean): void {
  * already ask to reuse it.
  */
 function deployBootstrap(cfg: DeployConfig, reuseOidc: boolean): void {
+  const template = resolveDeployAsset("bootstrap.yaml");
+  if (!template) {
+    console.error(
+      "  ✗ bootstrap.yaml template not found in the rastack package. Reinstall\n" +
+        "    rastack (`npm i -g rastack`) or run from the framework repo.",
+    );
+    process.exit(1);
+  }
   try {
-    awsRun(bootstrapStackArgs(cfg, reuseOidc));
+    awsRun(bootstrapStackArgs(cfg, reuseOidc, template));
   } catch (err) {
     if (reuseOidc) {
       console.error(
@@ -182,7 +193,7 @@ function deployBootstrap(cfg: DeployConfig, reuseOidc: boolean): void {
       "  • retrying bootstrap, reusing the account's existing GitHub OIDC provider",
     );
     try {
-      awsRun(bootstrapStackArgs(cfg, true));
+      awsRun(bootstrapStackArgs(cfg, true, template));
     } catch (retryErr) {
       console.error(
         `\n  ✗ bootstrap stack deploy failed.\n    ${(retryErr as Error).message}`,
@@ -237,8 +248,8 @@ function standUp(cfg: DeployConfig, reuseOidc: boolean): void {
   console.log("\n▸ Uploading the Lambda placeholder bundle");
   if (!uploadPlaceholder(artifactsBucket, cfg.region)) {
     console.error(
-      "  ✗ deploy/cloudformation/placeholder/bootstrap not found — the placeholder\n" +
-        "    was not uploaded. `rastack init` will upload it on the first app deploy.",
+      "  ✗ Lambda placeholder bundle not found in the rastack package — the\n" +
+        "    placeholder was not uploaded. `rastack init` will upload it on the first app deploy.",
     );
   } else {
     console.log("  ✓ placeholder uploaded");

package/src/rastack-init.ts

@@ -56,6 +56,7 @@ import {
   ghAvailable,
   gitRemoteUrl,
   loadConfig,
+  resolveDeployAsset,
   saveConfig,
   setRepoVariable,
   stackOutput,
@@ -209,13 +210,15 @@ function printPlan(cfg: DeployConfig): void {
   const withBucket = mergeConfig(cfg, {
     artifactsBucket: bucket ?? "<ArtifactsBucketName from bootstrap stack>",
   });
+  const bootstrapTemplate = resolveDeployAsset("bootstrap.yaml") ?? undefined;
+  const appTemplate = resolveDeployAsset("app.yaml") ?? undefined;
   console.log(`\n  Deployment plan (${cfg.stackName} @ ${cfg.region})\n`);
   console.log(
     `  ── 1. Bootstrap stack (${bootstrapStackName(cfg)}) — run only if it does not exist ──`,
   );
-  console.log("\n  " + bootstrapStackCommand(cfg) + "\n");
+  console.log("\n  " + bootstrapStackCommand(cfg, false, bootstrapTemplate) + "\n");
   console.log("  ── 2. Per-app backend (app.yaml) ──");
-  console.log("\n  " + deployStackCommand(withBucket) + "\n");
+  console.log("\n  " + deployStackCommand(withBucket, appTemplate) + "\n");
   console.log(
     "  ── 3. Wire these GitHub repo Variables from the stack Outputs ──",
   );
@@ -285,7 +288,7 @@ async function standUp(
   console.log("\n▸ Uploading the Lambda placeholder bundle");
   if (!uploadPlaceholder(artifactsBucket, cfg.region)) {
     console.error(
-      "  ✗ deploy/cloudformation/placeholder/bootstrap not found — cannot create the function.",
+      "  ✗ Lambda placeholder bundle not found in the rastack package — cannot create the function.",
     );
     process.exit(1);
   }
@@ -295,9 +298,17 @@ async function standUp(
     artifactsBucket,
     templatesBucket: templatesBucket ?? undefined,
   });
+  const appTemplate = resolveDeployAsset("app.yaml");
+  if (!appTemplate) {
+    console.error(
+      "  ✗ app.yaml template not found in the rastack package. Reinstall rastack\n" +
+        "    (`npm i -g rastack`) or run from the framework repo.",
+    );
+    process.exit(1);
+  }
   console.log(`\n▸ Deploying ${cfg.stackName}`);
   try {
-    awsRun(deployStackArgs(cfg));
+    awsRun(deployStackArgs(cfg, appTemplate));
   } catch (err) {
     console.error(
       `\n  ✗ aws cloudformation deploy failed for ${cfg.stackName}.\n    ${(err as Error).message}`,
@@ -372,8 +383,16 @@ function wireRepoVariables(cfg: DeployConfig, interactive: boolean): void {
 
 /** Deploy the bootstrap stack, retrying once against an existing OIDC provider. */
 function deployBootstrap(cfg: DeployConfig): void {
+  const template = resolveDeployAsset("bootstrap.yaml");
+  if (!template) {
+    console.error(
+      "  ✗ bootstrap.yaml template not found in the rastack package. Reinstall\n" +
+        "    rastack (`npm i -g rastack`) or run from the framework repo.",
+    );
+    process.exit(1);
+  }
   try {
-    awsRun(bootstrapStackArgs(cfg));
+    awsRun(bootstrapStackArgs(cfg, false, template));
   } catch {
     // The most common cause is an account that already has a GitHub OIDC
     // provider (only one is allowed per URL). Retry telling the template to
@@ -382,7 +401,7 @@ function deployBootstrap(cfg: DeployConfig): void {
       "  • retrying bootstrap, reusing the account's existing GitHub OIDC provider",
     );
     try {
-      awsRun(bootstrapStackArgs(cfg, true));
+      awsRun(bootstrapStackArgs(cfg, true, template));
     } catch (err) {
       console.error(
         `\n  ✗ bootstrap stack deploy failed.\n    ${(err as Error).message}`,

package/src/rastack-update.ts

@@ -24,6 +24,7 @@ import {
   globalPrefixFromPackageDir,
   npmBinary,
   npmInstallArgs,
+  npmSpawnShell,
   parseUpdateFlags,
   updateAvailable,
 } from "./update";
@@ -31,6 +32,13 @@ import {
 /** The npm executable for this platform (`npm.cmd` on Windows, else `npm`). */
 const NPM = npmBinary();
 
+/**
+ * Whether to launch npm through a shell. Required on Windows, where a bare
+ * `.cmd` spawn is rejected with `EINVAL` since the Node CVE-2024-27980 fix;
+ * false on POSIX so the direct spawn stays injection-free.
+ */
+const NPM_SHELL = npmSpawnShell();
+
 /** The installed rastack package directory (…/rastack), one up from dist/. */
 const PKG_DIR = path.join(__dirname, "..");
 const PKG_JSON = path.join(PKG_DIR, "package.json");
@@ -49,6 +57,7 @@ function npmCapture(args: string[]): string | null {
   try {
     return execFileSync(NPM, args, {
       stdio: ["ignore", "pipe", "pipe"],
+      shell: NPM_SHELL,
     })
       .toString()
       .trim();
@@ -103,10 +112,12 @@ function main(argv: string[]): void {
     `\n▸ Updating rastack (${current} → ${flags.version}) in ${prefix}\n`,
   );
   try {
-    // Re-runs the developer's own npm to update this global package — no
-    // untrusted input, and execFileSync (no shell) avoids any injection.
+    // Re-runs the developer's own npm to update this global package. On Windows
+    // the `.cmd` shim is launched through a shell (EINVAL otherwise); the only
+    // caller-supplied token — the version — is sanitized in `parseUpdateFlags`,
+    // and every other arg is a fixed literal, so nothing injectable reaches it.
     // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process
-    execFileSync(NPM, args, { stdio: "inherit", env });
+    execFileSync(NPM, args, { stdio: "inherit", env, shell: NPM_SHELL });
   } catch (err) {
     console.error(
       `\n  ✗ npm failed to update rastack. Re-run for detail:\n    npm install -g ${npmInstallArgs(flags.version)[2]}\n    ${(err as Error).message}`,

package/src/update.ts

@@ -40,27 +40,56 @@ export function parseUpdateFlags(argv: string[]): UpdateFlags {
         break;
       case "--version":
       case "--to":
-        version = argv[++i] ?? "latest";
+        version = sanitizeVersion(argv[++i]);
         break;
       default:
         // A bare, non-flag token is taken as the target version.
-        if (!a.startsWith("-")) version = a;
+        if (!a.startsWith("-")) version = sanitizeVersion(a);
     }
   }
   return { version, check, dryRun };
 }
 
+/**
+ * Constrain the update target to a safe npm version or dist-tag. The Windows
+ * update path runs npm through a shell (see `npmSpawnShell`), so the target —
+ * the one caller-supplied token that reaches the command line — must not be
+ * able to carry shell metacharacters. A valid npm spec starts alphanumeric and
+ * uses only `A-Za-z0-9._-` (e.g. `latest`, `next`, `0.0.40`, `1.2.3-beta.1`);
+ * anything else falls back to `latest`.
+ */
+export function sanitizeVersion(version: string | undefined): string {
+  return version && /^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(version)
+    ? version
+    : "latest";
+}
+
 /**
  * The npm executable to spawn for a platform. On Windows npm is a `.cmd` shim,
  * not a real executable, so `execFile("npm", …)` (no shell) fails with
  * `spawnSync npm ENOENT` — the direct-spawn path only resolves real binaries,
  * never `PATHEXT` scripts. Spawn `npm.cmd` there; POSIX keeps plain `npm`.
  * (`aws` is unaffected — it installs as `aws.exe`, a real executable.)
+ *
+ * The `.cmd` must still be launched through a shell — see `npmSpawnShell`.
  */
 export function npmBinary(platform: string = process.platform): string {
   return platform === "win32" ? "npm.cmd" : "npm";
 }
 
+/**
+ * Whether npm must be spawned through a shell on this platform. Since the Node
+ * fix for CVE-2024-27980 (18.20.2 / 20.12.2 / 21.7.2), spawning a `.cmd` shim
+ * like `npm.cmd` *without* a shell is rejected with `spawnSync npm.cmd EINVAL`
+ * — the very failure a Windows/PowerShell `rastack update` hits. cmd.exe knows
+ * how to run a `.cmd`, so Windows spawns through the shell; POSIX keeps the
+ * direct, shell-free spawn (npm is a real script resolved on PATH there, and no
+ * shell means no injection surface).
+ */
+export function npmSpawnShell(platform: string = process.platform): boolean {
+  return platform === "win32";
+}
+
 /** The npm package spec to install for a target version. */
 export function installSpec(version: string): string {
   return !version || version === "latest" ? "rastack" : `rastack@${version}`;

package/test/deploy.spec.ts

@@ -243,6 +243,19 @@ describe("stack parameters + launch command", () => {
       "deploy",
     ]);
   });
+
+  it("accepts a template-file override (the package-resolved path)", () => {
+    // `init` runs in a consumer repo that carries no framework IaC, so it passes
+    // the path the template was resolved to inside the `rastack` package.
+    const cfg = base({ artifactsBucket: "art" });
+    const abs = "/opt/rastack/dist/templates/cloudformation/app.yaml";
+    expect(deployStackArgs(cfg, abs)).toContain(abs);
+    expect(deployStackCommand(cfg, abs)).toContain(`--template-file ${abs}`);
+    // Default is unchanged when no override is given.
+    expect(deployStackCommand(cfg)).toContain(
+      "--template-file deploy/cloudformation/app.yaml",
+    );
+  });
 });
 
 describe("bootstrap stack", () => {
@@ -281,6 +294,21 @@ describe("bootstrap stack", () => {
     expect(`aws ${bootstrapStackArgs(base()).join(" ")}`).toBe(cmd);
   });
 
+  it("accepts a template-file override (the package-resolved path)", () => {
+    const abs = "/opt/rastack/dist/templates/cloudformation/bootstrap.yaml";
+    expect(bootstrapStackArgs(base(), false, abs)).toContain(abs);
+    expect(bootstrapStackCommand(base(), true, abs)).toContain(
+      `--template-file ${abs}`,
+    );
+    // Reuse-OIDC + override compose without disturbing the default path.
+    expect(bootstrapStackArgs(base(), true, abs)).toContain(
+      "CreateOIDCProvider=false",
+    );
+    expect(bootstrapStackCommand(base())).toContain(
+      "--template-file deploy/cloudformation/bootstrap.yaml",
+    );
+  });
+
   it("validates only the account-level fields, not the per-app ones", () => {
     // A config with no `app` is fine for bootstrap — it never touches app.yaml.
     const cfg = normalizeConfig({
@@ -513,3 +541,28 @@ describe("scaffold", () => {
     expect(files.map((f) => f.path)).toEqual([CONFIG_PATH]);
   });
 });
+
+describe("resolveDeployAsset — bundled template resolution", () => {
+  // eslint-disable-next-line @typescript-eslint/no-var-requires
+  const { resolveDeployAsset } = require("../src/deploy/io");
+  const path = require("path");
+
+  it("resolves the framework templates to an existing file", () => {
+    for (const name of ["app.yaml", "bootstrap.yaml"]) {
+      const resolved = resolveDeployAsset(name);
+      expect(resolved).not.toBeNull();
+      expect(path.isAbsolute(resolved)).toBe(true);
+      expect(resolved.endsWith(name)).toBe(true);
+    }
+  });
+
+  it("resolves the Lambda placeholder bundle", () => {
+    const resolved = resolveDeployAsset(path.join("placeholder", "bootstrap"));
+    expect(resolved).not.toBeNull();
+    expect(resolved.endsWith(path.join("placeholder", "bootstrap"))).toBe(true);
+  });
+
+  it("returns null for an asset that does not exist", () => {
+    expect(resolveDeployAsset("does-not-exist.yaml")).toBeNull();
+  });
+});

package/test/update.spec.ts

@@ -4,7 +4,9 @@ import {
   installSpec,
   npmBinary,
   npmInstallArgs,
+  npmSpawnShell,
   parseUpdateFlags,
+  sanitizeVersion,
   updateAvailable,
 } from "../src/update";
 
@@ -56,6 +58,39 @@ describe("update — npm spec + args", () => {
     expect(npmBinary("linux")).toBe("npm");
     expect(npmBinary("darwin")).toBe("npm");
   });
+
+  it("runs npm through a shell only on Windows", () => {
+    // A `.cmd` shim can't be spawned directly since the Node CVE-2024-27980 fix
+    // (spawnSync npm.cmd EINVAL) — it must go through cmd.exe. POSIX spawns npm
+    // directly so there is no shell and no injection surface.
+    expect(npmSpawnShell("win32")).toBe(true);
+    expect(npmSpawnShell("linux")).toBe(false);
+    expect(npmSpawnShell("darwin")).toBe(false);
+  });
+});
+
+describe("update — version sanitization", () => {
+  it("keeps valid semver, dist-tags, and pinned versions", () => {
+    expect(sanitizeVersion("latest")).toBe("latest");
+    expect(sanitizeVersion("next")).toBe("next");
+    expect(sanitizeVersion("0.0.40")).toBe("0.0.40");
+    expect(sanitizeVersion("1.2.3-beta.1")).toBe("1.2.3-beta.1");
+  });
+
+  it("falls back to latest for empty or shell-unsafe input", () => {
+    expect(sanitizeVersion(undefined)).toBe("latest");
+    expect(sanitizeVersion("")).toBe("latest");
+    // Shell metacharacters must never reach the Windows shell-spawned npm.
+    expect(sanitizeVersion("0.0.40; rm -rf /")).toBe("latest");
+    expect(sanitizeVersion("$(whoami)")).toBe("latest");
+    expect(sanitizeVersion("a b")).toBe("latest");
+  });
+
+  it("is applied when parsing the bare positional and --version", () => {
+    expect(parseUpdateFlags(["0.0.40; evil"]).version).toBe("latest");
+    expect(parseUpdateFlags(["--version", "&& evil"]).version).toBe("latest");
+    expect(parseUpdateFlags(["0.0.40"]).version).toBe("0.0.40");
+  });
 });
 
 describe("update — global prefix derivation", () => {