timonel 2.2.0 → 2.3.0

package/dist/lib/security.js

@@ -0,0 +1,117 @@
+import * as path from 'path';
+/**
+ * Security utilities for input validation and sanitization
+ * Focused on CLI tool security concerns: path traversal, injection prevention
+ */
+export class SecurityUtils {
+    /**
+     * Validates and sanitizes file paths to prevent path traversal attacks
+     * @param inputPath - The path to validate
+     * @param allowedBasePath - The base path that the input should be within
+     * @returns Sanitized path if valid
+     * @throws Error if path is invalid or contains traversal sequences
+     */
+    static validatePath(inputPath, allowedBasePath) {
+        if (!inputPath || typeof inputPath !== 'string') {
+            throw new Error('Invalid path: path must be a non-empty string');
+        }
+        // Check for path traversal sequences
+        if (inputPath.includes('../') ||
+            inputPath.includes('..\\') ||
+            inputPath.includes('%2e%2e%2f') ||
+            inputPath.includes('%2e%2e%5c')) {
+            throw new Error('Invalid path: path traversal sequences detected');
+        }
+        // Resolve and normalize paths
+        const resolvedInput = path.resolve(inputPath);
+        const resolvedBase = path.resolve(allowedBasePath);
+        // Ensure the resolved path is within the allowed base path
+        if (!resolvedInput.startsWith(resolvedBase + path.sep) && resolvedInput !== resolvedBase) {
+            throw new Error(`Invalid path: path must be within ${resolvedBase}`);
+        }
+        return resolvedInput;
+    }
+    /**
+     * Sanitizes log messages to prevent log injection attacks
+     * @param message - The message to sanitize
+     * @returns Sanitized message with control characters removed
+     */
+    static sanitizeLogMessage(message) {
+        if (typeof message !== 'string') {
+            return String(message);
+        }
+        // Remove control characters (ASCII 0-31 and 127) and normalize line endings
+        return (message
+            // eslint-disable-next-line no-control-regex -- Intentionally removing control characters for security
+            .replace(/[\x00-\x1F\x7F]/g, '') // Remove control characters
+            .replace(/\r\n/g, ' ') // Replace CRLF with space
+            .replace(/[\r\n]/g, ' ') // Replace remaining CR/LF with space
+            .trim());
+    }
+    /**
+     * Sanitizes environment names to prevent path traversal (CWE-22)
+     * @param env - Environment name to sanitize
+     * @returns Sanitized environment name
+     * @throws Error if environment name is invalid
+     */
+    static sanitizeEnvironmentName(env) {
+        if (!env || typeof env !== 'string') {
+            throw new Error('Environment name must be a non-empty string');
+        }
+        // Allow only alphanumeric, hyphens, and underscores
+        const sanitized = env.replace(/[^a-zA-Z0-9-_]/g, '');
+        if (sanitized !== env) {
+            throw new Error(`Invalid environment name: ${this.sanitizeLogMessage(env)}`);
+        }
+        if (sanitized.length === 0 || sanitized.length > 63) {
+            throw new Error('Environment name must be 1-63 characters long');
+        }
+        return sanitized;
+    }
+    /**
+     * Validates TypeScript file extensions for dynamic imports
+     * @param filePath - The file path to validate
+     * @returns True if the file has a valid TypeScript extension
+     */
+    static isValidTypeScriptFile(filePath) {
+        const allowedExtensions = ['.ts', '.tsx'];
+        const ext = path.extname(filePath);
+        return allowedExtensions.includes(ext);
+    }
+    /**
+     * Validates Helm template path syntax
+     * @param templatePath - The template path to validate
+     * @returns True if the path is valid for Helm templates
+     */
+    static isValidHelmTemplatePath(templatePath) {
+        if (!templatePath || typeof templatePath !== 'string') {
+            return false;
+        }
+        // Basic validation for dot notation and no special characters that could break Helm
+        const helmPathRegex = /^[a-zA-Z][a-zA-Z0-9._-]*$/;
+        return helmPathRegex.test(templatePath);
+    }
+    /**
+     * Validates chart names according to Helm conventions
+     * @param chartName - Chart name to validate
+     * @returns True if chart name follows Helm naming rules
+     */
+    static isValidChartName(chartName) {
+        if (!chartName || typeof chartName !== 'string') {
+            return false;
+        }
+        // Helm chart name validation (RFC 1123 subdomain) - safe regex
+        // eslint-disable-next-line security/detect-unsafe-regex -- Simple character class regex is safe
+        const chartNameRegex = /^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/;
+        return chartNameRegex.test(chartName) && chartName.length <= 63;
+    }
+    /**
+     * Validates subchart names according to Helm conventions
+     * @param subchartName - Subchart name to validate
+     * @returns True if subchart name is valid
+     */
+    static isValidSubchartName(subchartName) {
+        return this.isValidChartName(subchartName);
+    }
+}
+//# sourceMappingURL=security.js.map

package/dist/lib/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../../src/lib/security.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B;;;GAGG;AACH,MAAM,OAAO,aAAa;IACxB;;;;;;OAMG;IACH,MAAM,CAAC,YAAY,CAAC,SAAiB,EAAE,eAAuB;QAC5D,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QAED,qCAAqC;QACrC,IACE,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;YACzB,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC1B,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC;YAC/B,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,EAC/B,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QAED,8BAA8B;QAC9B,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC9C,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAEnD,2DAA2D;QAC3D,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,aAAa,KAAK,YAAY,EAAE,CAAC;YACzF,MAAM,IAAI,KAAK,CAAC,qCAAqC,YAAY,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,OAAO,aAAa,CAAC;IACvB,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,kBAAkB,CAAC,OAAe;QACvC,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;QAED,4EAA4E;QAC5E,OAAO,CACL,OAAO;YACL,sGAAsG;aACrG,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC,4BAA4B;aAC5D,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,0BAA0B;aAChD,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,qCAAqC;aAC7D,IAAI,EAAE,CACV,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,uBAAuB,CAAC,GAAW;QACxC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;QAED,oDAAoD;QACpD,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;QAErD,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/E,CAAC;QAED,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,qBAAqB,CAAC,QAAgB;QAC3C,MAAM,iBAAiB,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACnC,OAAO,iBAAiB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACzC,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,uBAAuB,CAAC,YAAoB;QACjD,IAAI,CAAC,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;YACtD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,oFAAoF;QACpF,MAAM,aAAa,GAAG,2BAA2B,CAAC;QAClD,OAAO,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC1C,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,gBAAgB,CAAC,SAAiB;QACvC,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAChD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,+DAA+D;QAC/D,gGAAgG;QAChG,MAAM,cAAc,GAAG,iCAAiC,CAAC;QACzD,OAAO,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,MAAM,IAAI,EAAE,CAAC;IAClE,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,mBAAmB,CAAC,YAAoB;QAC7C,OAAO,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;IAC7C,CAAC;CACF"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "timonel",
   "type": "module",
-  "version": "2.2.0",
+  "version": "2.3.0",
   "description": "Timonel: programmatic Helm chart generator using cdk8s (TypeScript)",
   "bin": {
     "timonel": "dist/cli.js",