timonel 2.10.1 → 2.10.2

package/CHANGELOG.md

@@ -1,3 +1,9 @@
+## [2.10.2](https://github.com/KenkoGeek/timonel/compare/v2.10.1...v2.10.2) (2025-09-20)
+
+### Bug Fixes
+
+- **cli:** consolidate path validation and improve error handling ([239a50f](https://github.com/KenkoGeek/timonel/commit/239a50fb30be451301d2af6a586b77748a3db6ec))
+
 ## [2.10.1](https://github.com/KenkoGeek/timonel/compare/v2.10.0...v2.10.1) (2025-09-20)
 
 ### Bug Fixes

package/dist/cli.js

@@ -9,23 +9,6 @@ const __dirname = path.dirname(__filename);
 const UMBRELLA_CONFIG_FILE = 'umbrella.config.json';
 const UMBRELLA_FILE_NAME = 'umbrella.ts';
 const PACKAGE_JSON_FILE = 'package.json';
-function isValidPath(filePath, expectedFileName) {
-    try {
-        const resolvedPath = path.resolve(filePath);
-        const normalizedPath = path.normalize(resolvedPath);
-        if (normalizedPath.includes('..') || normalizedPath.includes('~')) {
-            return false;
-        }
-        if (!normalizedPath.endsWith(expectedFileName)) {
-            return false;
-        }
-        const suspiciousPatterns = ['\\', '..', '~', '$', '`', '|', '&', ';', '(', ')'];
-        return !suspiciousPatterns.some((pattern) => normalizedPath.includes(pattern));
-    }
-    catch {
-        return false;
-    }
-}
 function getVersion() {
     try {
         const possiblePaths = [
@@ -35,18 +18,21 @@ function getVersion() {
             path.resolve(__dirname, PACKAGE_JSON_FILE),
         ];
         for (const packagePath of possiblePaths) {
-            if (!isValidPath(packagePath, PACKAGE_JSON_FILE)) {
-                continue;
-            }
-            if (fs.existsSync(packagePath)) {
-                try {
-                    const packageJson = JSON.parse(fs.readFileSync(packagePath, 'utf8'));
-                    return packageJson.version || 'unknown';
-                }
-                catch {
-                    continue;
+            try {
+                const validatedPath = SecurityUtils.validatePath(packagePath, process.cwd());
+                if (fs.existsSync(validatedPath)) {
+                    try {
+                        const packageJson = JSON.parse(fs.readFileSync(validatedPath, 'utf8'));
+                        return packageJson.version || 'unknown';
+                    }
+                    catch {
+                        continue;
+                    }
                 }
             }
+            catch {
+                continue;
+            }
         }
         if (process.env.npm_package_version) {
             return process.env.npm_package_version;
@@ -64,7 +50,7 @@ function log(msg, silent = false) {
 }
 function logError(msg, silent = false) {
     if (!silent) {
-        console.error(msg);
+        console.error(SecurityUtils.sanitizeLogMessage(msg));
     }
 }
 function usageAndExit(msg, silent = false) {
@@ -508,7 +494,7 @@ async function main() {
 main().catch((error) => {
     const flags = parseFlags(process.argv.slice(2));
     if (!flags.silent) {
-        console.error('Error:', error.message);
+        console.error('Error:', SecurityUtils.sanitizeLogMessage(error.message));
     }
     process.exit(1);
 });

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "timonel",
   "type": "module",
-  "version": "2.10.1",
+  "version": "2.10.2",
   "description": "Timonel: programmatic Helm chart generator using cdk8s (TypeScript)",
   "bin": {
     "timonel": "dist/cli.js",
@@ -37,7 +37,9 @@
     "deps:update": "pnpm update --latest",
     "md:lint": "markdownlint \"**/*.md\"",
     "md:fix": "markdownlint --fix \"**/*.md\"",
-    "test:integration": "vitest run --config vitest.config.ts",
+    "test": "vitest run --config vitest.config.ts",
+    "test:unit": "vitest run --config vitest.config.ts",
+    "test:integration": "vitest run --config vitest.integration.config.ts",
     "test:watch": "vitest",
     "test:coverage": "vitest run --coverage",
     "ci:check": "pnpm typecheck && pnpm lint && pnpm format:check && pnpm build",