ticketlens 0.9.8 → 0.9.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ticketlens",
-  "version": "0.9.8",
+  "version": "0.9.9",
   "description": "Jira CLI for developers — fetch ticket context, triage your queue, and stop tab-switching. Zero dependencies, all local.",
   "type": "module",
   "bin": {

package/skills/jtb/SKILL.md

@@ -1,4 +1,4 @@
-<!-- jtb-skill-version: 0.9.7 -->
+<!-- jtb-skill-version: 0.9.9 -->
 ---
 name: jtb
 description: Fetch a Jira ticket's full context (description, comments, linked issues, code references) and assemble a structured TicketBrief for implementation planning. Use when user types /jtb, mentions a Jira ticket key, or wants to plan work from a Jira ticket.

package/skills/jtb/scripts/lib/api-utils.mjs

@@ -3,7 +3,7 @@
  * Centralised here to avoid triplicating the regex and warning logic.
  */
 
-export const DEFAULT_API_BASE = 'http://api.ticketlens.test';
+export const DEFAULT_API_BASE = 'https://api.ticketlens.app';
 
 // Matches localhost, 127.0.0.1, and any hostname ending in .test or .local,
 // with an optional port — all treated as local-only addresses.

package/skills/jtb/scripts/lib/attachment-downloader.mjs

@@ -83,7 +83,8 @@ export async function downloadAttachments(ticket, opts = {}) {
       onProgress?.(`  download  ${a.filename}`);
       try {
         const headers = buildAuthHeader(env);
-        const response = await fetcher(a.content, { headers });
+        // redirect:'error' prevents a Jira redirect from leaking auth headers to a different origin.
+        const response = await fetcher(a.content, { headers, redirect: 'error' });
         if (!response.ok) throw new Error(`HTTP ${response.status} (${response.statusText})`);
         const buffer = await response.arrayBuffer();
         fs.writeFileSync(localPath, Buffer.from(buffer));

package/skills/jtb/scripts/lib/brief-cache.mjs

@@ -19,7 +19,14 @@ export const DEFAULT_BRIEF_TTL = '4h'; // human-readable default for display/con
 export function briefCachePath(ticketKey, profileName, configDir = DEFAULT_CONFIG_DIR) {
   const safeProfile = (profileName || '_default').replace(/[^a-zA-Z0-9_\-]/g, '_');
   const safeKey = ticketKey.replace(/[^a-zA-Z0-9_\-]/g, '_');
-  return path.join(configDir, 'cache', safeProfile, safeKey, 'brief.json');
+  const resolvedDir = path.resolve(configDir);
+  const result = path.join(resolvedDir, 'cache', safeProfile, safeKey, 'brief.json');
+  // Defense-in-depth: ensure the final path cannot escape the config directory,
+  // even if configDir itself is manipulated or the sanitization above is weakened.
+  if (!result.startsWith(resolvedDir + path.sep)) {
+    throw new Error(`Cache path escapes config directory: ${result}`);
+  }
+  return result;
 }
 
 /**

package/skills/jtb/scripts/lib/jira-client.mjs

@@ -81,6 +81,35 @@ export function normalizeTicket(raw) {
   };
 }
 
+// RFC-1918 + link-local + loopback + localhost blocked to prevent SSRF.
+const BLOCKED_PATTERNS = [
+  /^127\./,
+  /^10\./,
+  /^172\.(1[6-9]|2\d|3[01])\./,
+  /^192\.168\./,
+  /^169\.254\./,
+  /^0\.0\.0\.0$/,
+  /^::1$/,
+  /^::ffff:/i,
+  /^fc00:/i,
+  /^fe80:/i,
+  /^localhost$/i,
+];
+
+export function validateBaseUrl(url) {
+  let parsed;
+  try { parsed = new URL(url); } catch {
+    throw new Error(`JIRA_BASE_URL is not a valid URL: ${url}`);
+  }
+  if (parsed.protocol !== 'https:') {
+    throw new Error(`JIRA_BASE_URL must use HTTPS (got ${parsed.protocol})`);
+  }
+  const hostname = parsed.hostname.replace(/^\[|\]$/g, '');
+  if (BLOCKED_PATTERNS.some(re => re.test(hostname))) {
+    throw new Error(`JIRA_BASE_URL hostname is blocked (${hostname})`);
+  }
+}
+
 export function buildAuthHeader(env) {
   if (env.JIRA_PAT) {
     return { Authorization: `Bearer ${env.JIRA_PAT}` };
@@ -91,6 +120,7 @@ export function buildAuthHeader(env) {
 
 export async function fetchCurrentUser(opts = {}) {
   const { env = process.env, fetcher = globalThis.fetch, apiVersion = 2, timeoutMs = 10_000 } = opts;
+  validateBaseUrl(env.JIRA_BASE_URL);
   const baseUrl = env.JIRA_BASE_URL.replace(/\/$/, '');
   const headers = { ...buildAuthHeader(env), 'Content-Type': 'application/json' };
 
@@ -116,6 +146,7 @@ export async function fetchCurrentUser(opts = {}) {
 
 export async function fetchStatuses(opts = {}) {
   const { env = process.env, fetcher = globalThis.fetch, apiVersion = 2, timeoutMs = 10_000 } = opts;
+  validateBaseUrl(env.JIRA_BASE_URL);
   const baseUrl = env.JIRA_BASE_URL.replace(/\/$/, '');
   const headers = { ...buildAuthHeader(env), 'Content-Type': 'application/json' };
 
@@ -136,6 +167,7 @@ export async function fetchStatuses(opts = {}) {
 
 export async function searchTickets(jql, opts = {}) {
   const { env = process.env, fetcher = globalThis.fetch, maxResults = 50, apiVersion = 2, timeoutMs = 10_000, expandChangelog = false } = opts;
+  validateBaseUrl(env.JIRA_BASE_URL);
   const baseUrl = env.JIRA_BASE_URL.replace(/\/$/, '');
   const headers = { ...buildAuthHeader(env), 'Content-Type': 'application/json' };
 
@@ -163,6 +195,7 @@ export async function searchTickets(jql, opts = {}) {
 
 export async function fetchRemoteLinks(ticketKey, opts = {}) {
   const { env = process.env, fetcher = globalThis.fetch, apiVersion = 2, timeoutMs = 10_000 } = opts;
+  validateBaseUrl(env.JIRA_BASE_URL);
   const baseUrl = env.JIRA_BASE_URL.replace(/\/$/, '');
   const url = `${baseUrl}/rest/api/${apiVersion}/issue/${encodeURIComponent(ticketKey)}/remotelink`;
 
@@ -180,6 +213,7 @@ export async function fetchRemoteLinks(ticketKey, opts = {}) {
 
 export async function fetchTicket(ticketKey, opts = {}) {
   const { env = process.env, fetcher = globalThis.fetch, depth = 1, apiVersion = 2, timeoutMs = 10_000, expandChangelog = false, _visited = new Set(), _currentDepth = 0 } = opts;
+  validateBaseUrl(env.JIRA_BASE_URL);
   const baseUrl = env.JIRA_BASE_URL.replace(/\/$/, '');
   const headers = { ...buildAuthHeader(env), 'Content-Type': 'application/json' };