timonel 3.0.0-beta.1 → 3.0.0

package/dist/cli.js

@@ -142,8 +142,9 @@ async function cmdInit(name, silent = false) {
     if (!SecurityUtils.isValidChartName(validName)) {
         usageAndExit('Invalid chart name. Must be lowercase, start with a letter, and contain only letters, numbers, and dashes.');
     }
-    const base = path.join(process.cwd(), validName);
-    const chartFile = path.join(base, 'chart.ts');
+    const cwd = process.cwd();
+    const base = SecurityUtils.validatePath(path.join(cwd, validName), cwd);
+    const chartFile = SecurityUtils.validatePath(path.join(base, 'chart.ts'), cwd);
     fs.mkdirSync(base, { recursive: true });
     const { generateFlexibleSubchartTemplate } = await import('./lib/templates/flexible-subchart.js');
     fs.writeFileSync(chartFile, generateFlexibleSubchartTemplate(validName));
@@ -152,19 +153,31 @@ async function cmdInit(name, silent = false) {
     log(`Run 'tl synth ${validName}' to generate complete Helm chart`, silent);
 }
 async function cmdSynth(chartDirOrOutDir, flags, explicitOutDir) {
-    let chartDir = process.cwd();
+    const cwd = process.cwd();
+    let chartDir = cwd;
     let outDir;
-    if (chartDirOrOutDir && fs.existsSync(path.join(chartDirOrOutDir, 'chart.ts'))) {
-        chartDir = path.resolve(chartDirOrOutDir);
-    }
-    else {
-        outDir = chartDirOrOutDir;
+    if (chartDirOrOutDir) {
+        const resolvedPath = path.resolve(chartDirOrOutDir);
+        const validatedPath = SecurityUtils.validatePath(resolvedPath, cwd, { allowAbsolute: true });
+        const chartTsPath = SecurityUtils.validatePath(path.join(validatedPath, 'chart.ts'), cwd, {
+            allowAbsolute: true,
+        });
+        if (fs.existsSync(chartTsPath)) {
+            chartDir = validatedPath;
+        }
+        else {
+            outDir = chartDirOrOutDir;
+        }
     }
     if (explicitOutDir) {
         outDir = explicitOutDir;
     }
-    const chartFile = path.join(chartDir, 'chart.ts');
-    const defaultOutDir = path.join(chartDir, 'dist');
+    const chartFile = SecurityUtils.validatePath(path.join(chartDir, 'chart.ts'), cwd, {
+        allowAbsolute: true,
+    });
+    const defaultOutDir = SecurityUtils.validatePath(path.join(chartDir, 'dist'), cwd, {
+        allowAbsolute: true,
+    });
     if (!fs.existsSync(chartFile)) {
         console.error('chart.ts not found. Run `tl init` first.');
         process.exit(1);
@@ -177,7 +190,7 @@ async function cmdSynth(chartDirOrOutDir, flags, explicitOutDir) {
     if (modifiedContent === originalContent) {
         modifiedContent = originalContent.replace(/chart\.write\(['"][^'"]*['"]\)/, `chart.write('${safeOutDirLiteral}')`);
     }
-    const tempChartFile = path.join(chartDir, '.timonel-temp-chart.ts');
+    const tempChartFile = SecurityUtils.validatePath(path.join(chartDir, '.timonel-temp-chart.ts'), cwd, { allowAbsolute: true });
     fs.writeFileSync(tempChartFile, modifiedContent);
     const wrapperScript = `
 import { pathToFileURL } from 'url';
@@ -237,11 +250,34 @@ async function cmdValidate(flags) {
         process.exit(result.status ?? 1);
     }
 }
+function validateReleaseName(release) {
+    if (!/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/.test(release) || release.length > 53) {
+        console.error(`Invalid release name: ${SecurityUtils.sanitizeLogMessage(release)}`);
+        console.error('Release name must be lowercase alphanumeric with hyphens (max 53 chars)');
+        process.exit(1);
+    }
+}
+function validateNamespace(namespace) {
+    if (!/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/.test(namespace) || namespace.length > 63) {
+        console.error(`Invalid namespace: ${SecurityUtils.sanitizeLogMessage(namespace)}`);
+        console.error('Namespace must be lowercase alphanumeric with hyphens (max 63 chars)');
+        process.exit(1);
+    }
+}
+function validateSetFlag(setValue) {
+    if (!/^[a-zA-Z0-9._[\]-]+=.+$/.test(setValue)) {
+        console.error(`Invalid --set format: ${SecurityUtils.sanitizeLogMessage(setValue)}`);
+        console.error('Expected format: key=value');
+        process.exit(1);
+    }
+}
 async function cmdDeploy(release, namespace, flags) {
     if (!release)
         usageAndExit('Missing <release>');
+    validateReleaseName(release);
     const args = ['upgrade', '--install', release, '.'];
     if (namespace) {
+        validateNamespace(namespace);
         args.push('--namespace', namespace);
     }
     if (flags?.env) {
@@ -256,6 +292,7 @@ async function cmdDeploy(release, namespace, flags) {
     }
     if (flags?.set) {
         for (const setValue of flags.set) {
+            validateSetFlag(setValue);
             args.push('--set', setValue);
         }
     }
@@ -465,7 +502,7 @@ async function cmdUmbrellaAdd(subchartPath, silent = false) {
     fs.mkdirSync(subchartDir, { recursive: true });
     const relativeSubchartPath = path.relative(chartsRoot, subchartDir) || subchartName;
     const normalizedSubchartPath = relativeSubchartPath.split(path.sep).join('/');
-    const chartFile = path.join(subchartDir, 'chart.ts');
+    const chartFile = SecurityUtils.validatePath(path.join(subchartDir, 'chart.ts'), chartsRoot);
     const { generateFlexibleSubchartTemplate } = await import('./lib/templates/flexible-subchart.js');
     const subchartContent = generateFlexibleSubchartTemplate(subchartName);
     fs.writeFileSync(chartFile, subchartContent);
@@ -479,8 +516,9 @@ async function cmdUmbrellaAdd(subchartPath, silent = false) {
     log(`Subchart ${subchartName} added to umbrella at path '${normalizedSubchartPath}'`, silent);
 }
 async function cmdUmbrellaSynth(outDir, flags) {
-    const umbrellaFile = path.join(process.cwd(), UMBRELLA_FILE_NAME);
-    const defaultOutDir = path.join(process.cwd(), 'dist');
+    const cwd = process.cwd();
+    const umbrellaFile = SecurityUtils.validatePath(path.join(cwd, UMBRELLA_FILE_NAME), cwd);
+    const defaultOutDir = SecurityUtils.validatePath(path.join(cwd, 'dist'), cwd);
     if (!fs.existsSync(umbrellaFile)) {
         console.error('umbrella.ts not found. Run `tl umbrella init` first.');
         process.exit(1);
@@ -511,7 +549,8 @@ fs.mkdirSync(output, { recursive: true });
 await Promise.resolve(runner(output, synthOptions));
 console.log('Umbrella chart written to ' + output);
 `;
-    const wrapperFile = path.join(process.cwd(), '.timonel-umbrella-wrapper.mjs');
+    const cwd = process.cwd();
+    const wrapperFile = SecurityUtils.validatePath(path.join(cwd, '.timonel-umbrella-wrapper.mjs'), cwd);
     try {
         fs.writeFileSync(wrapperFile, wrapperScript);
         const result = spawnSync(process.execPath, [TSX_CLI_PATH, wrapperFile], {

package/dist/lib/helm.js

@@ -36,6 +36,12 @@ export function indent(n, expr) {
         .join('\n');
 }
 export function template(name, context = '.') {
+    if (!isValidHelmPath(name)) {
+        throw new Error(`Invalid template name: ${name}`);
+    }
+    if (!isValidHelmPath(context)) {
+        throw new Error(`Invalid template context: ${context}`);
+    }
     return `{{ template "${name}" ${context} }}`;
 }
 export function include(name, context = '.') {
@@ -157,12 +163,33 @@ export function helmRange(collection, content, options = {}) {
     if (!collection.startsWith('.')) {
         throw new Error('Collection path must start with "." (e.g., ".Values.items")');
     }
+    if (!isValidHelmPath(collection)) {
+        throw new Error(`Invalid collection path: ${collection}`);
+    }
     const { keyValue = false, keyVar = '$key', valueVar = '$value', indexVar = '$index', itemVar = '$item', } = options;
+    const validateVarName = (varName, varType) => {
+        if (!varName.startsWith('$')) {
+            throw new Error(`${varType} must start with $ (e.g., $key, $value)`);
+        }
+        if (!/^\$[a-zA-Z_][a-zA-Z0-9_]*$/.test(varName)) {
+            throw new Error(`Invalid ${varType}: ${varName}`);
+        }
+    };
+    if (keyValue) {
+        validateVarName(keyVar, 'keyVar');
+        validateVarName(valueVar, 'valueVar');
+    }
+    if (options.indexVar !== undefined) {
+        validateVarName(indexVar, 'indexVar');
+    }
+    if (options.itemVar !== undefined) {
+        validateVarName(itemVar, 'itemVar');
+    }
     let rangeExpression;
     if (keyValue) {
         rangeExpression = `{{- range ${keyVar}, ${valueVar} := ${collection} }}`;
     }
-    else if (options.indexVar && options.itemVar) {
+    else if (options.indexVar !== undefined && options.itemVar !== undefined) {
         rangeExpression = `{{- range ${indexVar}, ${itemVar} := ${collection} }}`;
     }
     else {

package/dist/lib/helmChartWriter.js

@@ -35,7 +35,8 @@ export class HelmChartWriter {
         timer();
     }
     static createDirectories(outDir) {
-        fs.mkdirSync(path.join(outDir, 'templates'), { recursive: true });
+        const templatesDir = SecurityUtils.validatePath(path.join(outDir, 'templates'), outDir);
+        fs.mkdirSync(templatesDir, { recursive: true });
     }
     static writeChartYaml(outDir, meta) {
         const chartYaml = dumpHelmAwareYaml({
@@ -53,13 +54,16 @@ export class HelmChartWriter {
             icon: meta.icon,
             dependencies: meta.dependencies,
         });
-        fs.writeFileSync(path.join(outDir, 'Chart.yaml'), chartYaml);
+        const chartYamlPath = SecurityUtils.validatePath(path.join(outDir, 'Chart.yaml'), outDir);
+        fs.writeFileSync(chartYamlPath, chartYaml);
     }
     static writeValuesFiles(outDir, defaultValues, envValues) {
-        fs.writeFileSync(path.join(outDir, 'values.yaml'), dumpHelmAwareYaml(defaultValues));
+        const valuesPath = SecurityUtils.validatePath(path.join(outDir, 'values.yaml'), outDir);
+        fs.writeFileSync(valuesPath, dumpHelmAwareYaml(defaultValues));
         for (const [env, values] of Object.entries(envValues)) {
             const sanitizedEnv = SecurityUtils.sanitizeEnvironmentName(env);
-            fs.writeFileSync(path.join(outDir, `values-${sanitizedEnv}.yaml`), dumpHelmAwareYaml(values));
+            const envValuesPath = SecurityUtils.validatePath(path.join(outDir, `values-${sanitizedEnv}.yaml`), outDir);
+            fs.writeFileSync(envValuesPath, dumpHelmAwareYaml(values));
         }
     }
     static writeAssets(outDir, assets) {
@@ -77,20 +81,23 @@ export class HelmChartWriter {
                 .map((h) => [`{{- define "${h.name}" -}}`, h.template.trimEnd(), '{{- end }}', ''].join('\n'))
                 .join('\n');
         }
-        fs.writeFileSync(path.join(outDir, 'templates', '_helpers.tpl'), content);
+        const helpersPath = SecurityUtils.validatePath(path.join(outDir, 'templates', '_helpers.tpl'), outDir);
+        fs.writeFileSync(helpersPath, content);
     }
     static writeNotes(outDir, notesTpl) {
         if (!notesTpl)
             return;
-        fs.writeFileSync(path.join(outDir, 'templates', 'NOTES.txt'), notesTpl.endsWith('\n') ? notesTpl : notesTpl + '\n');
+        const notesPath = SecurityUtils.validatePath(path.join(outDir, 'templates', 'NOTES.txt'), outDir);
+        fs.writeFileSync(notesPath, notesTpl.endsWith('\n') ? notesTpl : notesTpl + '\n');
     }
     static writeSchema(outDir, valuesSchema) {
         if (!valuesSchema)
             return;
-        fs.writeFileSync(path.join(outDir, 'values.schema.json'), JSON.stringify(valuesSchema, null, 2) + '\n');
+        const schemaPath = SecurityUtils.validatePath(path.join(outDir, 'values.schema.json'), outDir);
+        fs.writeFileSync(schemaPath, JSON.stringify(valuesSchema, null, 2) + '\n');
     }
     static writeHelmIgnore(outDir) {
-        const helmIgnorePath = path.join(outDir, '.helmignore');
+        const helmIgnorePath = SecurityUtils.validatePath(path.join(outDir, '.helmignore'), outDir);
         if (!fs.existsSync(helmIgnorePath)) {
             const helmIgnore = [
                 '# VCS',
@@ -149,7 +156,13 @@ function writeSingleAssetFile(outDir, targetDir, directorySegments, fileBaseName
     const chartSubdir = path.join(outDir, targetDir, ...directorySegments);
     SecurityUtils.validatePath(chartSubdir, outDir);
     fs.mkdirSync(chartSubdir, { recursive: true });
+    if (fileBaseName.includes('..') || fileBaseName.includes('/') || fileBaseName.includes('\\')) {
+        throw new Error(`Invalid fileBaseName: ${fileBaseName}`);
+    }
     const filename = `${fileBaseName}.yaml`;
+    if (filename.includes('..') || filename.includes('/') || filename.includes('\\')) {
+        throw new Error(`Invalid filename: ${filename}`);
+    }
     const absolutePath = path.join(chartSubdir, filename);
     SecurityUtils.validatePath(absolutePath, outDir);
     const processedYaml = postProcessFieldConditionals(yaml);
@@ -162,8 +175,14 @@ function writeMultipleAssetFiles(outDir, targetDir, directorySegments, fileBaseN
     const processedYaml = postProcessFieldConditionals(yaml);
     const parts = splitDocs(processedYaml);
     parts.forEach((doc, index) => {
+        if (fileBaseName.includes('..') || fileBaseName.includes('/') || fileBaseName.includes('\\')) {
+            throw new Error(`Invalid fileBaseName: ${fileBaseName}`);
+        }
         const suffix = parts.length > 1 ? `-${index + 1}` : '';
         const filename = `${fileBaseName}${suffix}.yaml`;
+        if (filename.includes('..') || filename.includes('/') || filename.includes('\\')) {
+            throw new Error(`Invalid filename: ${filename}`);
+        }
         const absolutePath = path.join(chartSubdir, filename);
         SecurityUtils.validatePath(absolutePath, outDir);
         fs.writeFileSync(absolutePath, doc.endsWith('\n') ? doc : `${doc}\n`);

package/dist/lib/resources/baseResourceProvider.js

@@ -48,6 +48,11 @@ export class BaseResourceProvider {
     createRootLevelApiObject(name, apiVersion, kind, fields, labels, annotations) {
         this.validateKubernetesName(name, kind);
         this.validateLabels(labels, kind);
+        const reservedKeys = ['apiVersion', 'kind', 'metadata'];
+        const conflictingKeys = Object.keys(fields).filter((key) => reservedKeys.includes(key));
+        if (conflictingKeys.length > 0) {
+            throw new Error(`Fields object contains reserved keys: ${conflictingKeys.join(', ')}. These keys cannot be overridden.`);
+        }
         return new ApiObject(this.chart, name, {
             apiVersion,
             kind,

package/dist/lib/resources/cloud/aws/awsResources.js

@@ -120,7 +120,8 @@ export class AWSResources extends BaseResourceProvider {
             throw new Error(`Ingress path "${path}" must start with /`);
         }
         if (normalizedPath.includes('../') || normalizedPath.includes('./')) {
-            console.warn(`Warning: Ingress path "${path}" contains path traversal-like sequences`);
+            const sanitizedPath = path.replace(/[\r\n]/g, '');
+            console.warn(`Warning: Ingress path "${sanitizedPath}" contains path traversal-like sequences`);
         }
     }
     validatePathType(pathType) {

package/dist/lib/resources/cloud/aws/karpenterResources.js

@@ -15,8 +15,16 @@ export function isValidDisruptionBudget(budget) {
     return nodePattern.test(budget.nodes);
 }
 export function isValidKubernetesDuration(duration) {
-    const durationPattern = /^(\d+h)?(\d+m)?(\d+s)?$/;
-    return durationPattern.test(duration) && duration.length > 0;
+    try {
+        if (typeof duration !== 'string') {
+            return false;
+        }
+        const durationPattern = /^(\d+h)?(\d+m)?(\d+s)?$/;
+        return durationPattern.test(duration) && duration.length > 0;
+    }
+    catch {
+        return false;
+    }
 }
 export const DEFAULT_TERMINATION_GRACE_PERIOD = '30s';
 export class KarpenterResources extends BaseResourceProvider {
@@ -121,9 +129,15 @@ export class KarpenterResources extends BaseResourceProvider {
             nodePoolConfig['weight'] = spec.weight;
         }
         if (spec.labels) {
+            if (typeof spec.labels !== 'object' || Array.isArray(spec.labels)) {
+                throw new Error('Labels must be a valid object');
+            }
             nodePoolConfig['labels'] = spec.labels;
         }
         if (spec.annotations) {
+            if (typeof spec.annotations !== 'object' || Array.isArray(spec.annotations)) {
+                throw new Error('Annotations must be a valid object');
+            }
             nodePoolConfig['annotations'] = spec.annotations;
         }
         return this.addKarpenterNodePool(nodePoolConfig);

package/dist/lib/security.js

@@ -84,7 +84,7 @@ export class SecurityUtils {
         }
         const sanitized = env.replace(/[^a-zA-Z0-9-_]/g, '');
         if (sanitized !== env) {
-            throw new Error(`Invalid environment name: ${this.sanitizeLogMessage(env)}`);
+            throw new Error(`Invalid environment name: ${SecurityUtils.sanitizeLogMessage(env)}`);
         }
         if (sanitized.length === 0 || sanitized.length > 63) {
             throw new Error('Environment name must be 1-63 characters long');
@@ -150,7 +150,7 @@ export class SecurityUtils {
         }
         const nameRegex = /^[A-Z_][A-Z0-9_]*$/;
         if (!nameRegex.test(sanitizedName)) {
-            throw new Error(`Invalid environment variable name: ${this.sanitizeLogMessage(name)}`);
+            throw new Error(`Invalid environment variable name: ${SecurityUtils.sanitizeLogMessage(name)}`);
         }
         const hasDangerousPattern = (val) => {
             if (val.includes('$(') && val.includes(')'))
@@ -173,7 +173,7 @@ export class SecurityUtils {
         };
         const dangerousPattern = hasDangerousPattern(value);
         if (dangerousPattern) {
-            throw new Error(`Environment variable value contains dangerous pattern (${dangerousPattern}): ${this.sanitizeLogMessage(value)}`);
+            throw new Error(`Environment variable value contains dangerous pattern (${dangerousPattern}): ${SecurityUtils.sanitizeLogMessage(value)}`);
         }
         if (value.length > 32768) {
             throw new Error('Environment variable value exceeds maximum length (32KB)');
@@ -194,7 +194,7 @@ export class SecurityUtils {
         }
         const tagRegex = /^[a-zA-Z0-9._-]+$/;
         if (!tagRegex.test(trimmedTag)) {
-            throw new Error(`Invalid image tag format: ${this.sanitizeLogMessage(trimmedTag)}`);
+            throw new Error(`Invalid image tag format: ${SecurityUtils.sanitizeLogMessage(trimmedTag)}`);
         }
         if (trimmedTag.length > 128) {
             throw new Error('Image tag exceeds maximum length (128 characters)');

package/dist/lib/templates/flexible-subchart.js

@@ -1,6 +1,7 @@
 import { writeFileSync, mkdirSync, existsSync } from 'fs';
 import { join } from 'path';
 import { Chart } from 'cdk8s';
+import { SecurityUtils } from '../security.js';
 import { dumpHelmAwareYaml } from '../utils/helmYamlSerializer.js';
 import { generateHelpersTemplate } from '../utils/helmHelpers.js';
 export class FlexibleSubchart extends Chart {
@@ -51,13 +52,19 @@ export class FlexibleSubchart extends Chart {
             version: this.config.version || '1.0.0',
             appVersion: this.config.version || '1.0.0',
         };
-        writeFileSync(join(outputDir, 'Chart.yaml'), dumpHelmAwareYaml(subchartYaml));
+        const chartYamlPath = SecurityUtils.validatePath(join(outputDir, 'Chart.yaml'), process.cwd(), {
+            allowAbsolute: true,
+        });
+        writeFileSync(chartYamlPath, dumpHelmAwareYaml(subchartYaml));
         const subchartValues = {
             enabled: true,
             ...Object.fromEntries(Object.entries(this.config).filter(([key, value]) => key !== 'chart' && typeof value !== 'function' && value !== null && value !== undefined)),
         };
-        writeFileSync(join(outputDir, 'values.yaml'), dumpHelmAwareYaml(subchartValues));
-        const templatesDir = join(outputDir, 'templates');
+        const valuesYamlPath = SecurityUtils.validatePath(join(outputDir, 'values.yaml'), process.cwd(), { allowAbsolute: true });
+        writeFileSync(valuesYamlPath, dumpHelmAwareYaml(subchartValues));
+        const templatesDir = SecurityUtils.validatePath(join(outputDir, 'templates'), process.cwd(), {
+            allowAbsolute: true,
+        });
         if (!existsSync(templatesDir)) {
             mkdirSync(templatesDir, { recursive: true });
         }
@@ -65,13 +72,15 @@ export class FlexibleSubchart extends Chart {
             includeKubernetes: true,
             includeSprig: true,
         });
-        writeFileSync(join(templatesDir, '_helpers.tpl'), helpersTpl);
+        const helpersTplPath = SecurityUtils.validatePath(join(templatesDir, '_helpers.tpl'), process.cwd(), { allowAbsolute: true });
+        writeFileSync(helpersTplPath, helpersTpl);
         this._manifests.forEach((item) => {
             if (item && typeof item === 'object' && 'manifest' in item && 'id' in item) {
                 const { manifest, id } = item;
                 if (manifest && typeof manifest === 'object') {
                     const templateContent = this._generateManifestTemplate(manifest, id);
-                    writeFileSync(join(templatesDir, `${id}.yaml`), templateContent);
+                    const manifestPath = SecurityUtils.validatePath(join(templatesDir, `${id}.yaml`), process.cwd(), { allowAbsolute: true });
+                    writeFileSync(manifestPath, templateContent);
                 }
             }
         });

package/dist/lib/templates/umbrella-chart.js

@@ -2,6 +2,7 @@ import { writeFileSync, mkdirSync, existsSync, copyFileSync, readdirSync, rmSync
 import { join } from 'path';
 import { parse } from 'yaml';
 import { App, Chart, ApiObject } from 'cdk8s';
+import { SecurityUtils } from '../security.js';
 import { dumpHelmAwareYaml } from '../utils/helmYamlSerializer.js';
 import { generateHelpersTemplate } from '../utils/helmHelpers.js';
 import { createFlexibleSubchart } from './flexible-subchart.js';
@@ -227,10 +228,12 @@ export class UmbrellaChartTemplate extends Chart {
             else if (subchart.chart && typeof subchart.chart === 'object') {
                 this._handleObjectChart(subchart, flexibleSubchart);
             }
-            console.log(`Added flexible subchart: ${subchart.name}`);
+            const sanitizedName = subchart.name.replace(/[\r\n]/g, '');
+            console.log(`Added flexible subchart: ${sanitizedName}`);
         }
         catch (_error) {
-            console.warn(`Failed to add subchart ${subchart.name}:`, _error);
+            const sanitizedName = subchart.name.replace(/[\r\n]/g, '');
+            console.warn(`Failed to add subchart ${sanitizedName}:`, _error);
             this._createFallbackSubchart(subchart, index);
         }
     }
@@ -249,7 +252,8 @@ export class UmbrellaChartTemplate extends Chart {
             version: subchart.version || '1.0.0',
             description: `${subchart.name} subchart (fallback)`,
         });
-        console.log(`Created fallback subchart: ${subchart.name}`);
+        const sanitizedName = subchart.name.replace(/[\r\n]/g, '');
+        console.log(`Created fallback subchart: ${sanitizedName}`);
     }
     _handleFunctionChart(subchart, index, flexibleSubchart) {
         try {
@@ -263,7 +267,8 @@ export class UmbrellaChartTemplate extends Chart {
             }
         }
         catch (error) {
-            console.log(`Failed to process subchart ${subchart.name}:`, error);
+            const sanitizedName = subchart.name.replace(/[\r\n]/g, '');
+            console.log(`Failed to process subchart ${sanitizedName}:`, error);
         }
     }
     _handleObjectChart(subchart, flexibleSubchart) {
@@ -338,7 +343,8 @@ export class UmbrellaChartTemplate extends Chart {
                 }
             }
             catch (error) {
-                console.log(`Failed to parse asset ${asset.id}:`, error);
+                const sanitizedId = asset.id.replace(/[\r\n]/g, '');
+                console.log(`Failed to parse asset ${sanitizedId}:`, error);
             }
         });
     }
@@ -375,7 +381,8 @@ export class UmbrellaChartTemplate extends Chart {
             includeSprig: true,
         });
         writeFileSync(join(templatesDir, '_helpers.tpl'), helpersTpl);
-        console.log(`Created basic Helm chart structure for subchart: ${subchartName}`);
+        const sanitizedName = subchartName.replace(/[\r\n]/g, '');
+        console.log(`Created basic Helm chart structure for subchart: ${sanitizedName}`);
     }
     writeHelmChart(outputDir) {
         if (!existsSync(outputDir)) {
@@ -412,7 +419,7 @@ export class UmbrellaChartTemplate extends Chart {
             mkdirSync(chartsDir, { recursive: true });
         }
         this.config.subcharts?.forEach((subchart) => {
-            const subchartDir = join(chartsDir, subchart.name);
+            const subchartDir = SecurityUtils.validatePath(join(chartsDir, subchart.name), process.cwd(), { allowAbsolute: true });
             if (!existsSync(subchartDir)) {
                 mkdirSync(subchartDir, { recursive: true });
             }
@@ -444,7 +451,8 @@ export class UmbrellaChartTemplate extends Chart {
                         }
                     }
                     catch (fallbackError) {
-                        console.warn(`Failed to create subchart ${subchart.name}:`, fallbackError);
+                        const sanitizedName = subchart.name.replace(/[\r\n]/g, '');
+                        console.warn(`Failed to create subchart ${sanitizedName}:`, fallbackError);
                         flexibleSubchart.writeHelmChart(subchartDir);
                     }
                 }
@@ -462,7 +470,9 @@ export class UmbrellaChartTemplate extends Chart {
                 flexibleSubchart.writeHelmChart(subchartDir);
             }
         });
-        const templatesDir = join(outputDir, 'templates');
+        const templatesDir = SecurityUtils.validatePath(join(outputDir, 'templates'), process.cwd(), {
+            allowAbsolute: true,
+        });
         if (!existsSync(templatesDir)) {
             mkdirSync(templatesDir, { recursive: true });
         }
@@ -479,7 +489,8 @@ export class UmbrellaChartTemplate extends Chart {
                 },
             },
         };
-        writeFileSync(join(templatesDir, 'namespace.yaml'), dumpHelmAwareYaml(namespaceYaml));
+        const namespaceYamlPath = SecurityUtils.validatePath(join(templatesDir, 'namespace.yaml'), process.cwd(), { allowAbsolute: true });
+        writeFileSync(namespaceYamlPath, dumpHelmAwareYaml(namespaceYaml));
         const helpersTpl = generateHelpersTemplate('aws', undefined, {
             includeKubernetes: true,
             includeSprig: true,

package/dist/lib/umbrellaRutter.js

@@ -27,19 +27,24 @@ export class UmbrellaRutter {
             allowAbsolute: true,
         });
         mkdirSync(validatedOutDir, { recursive: true });
-        mkdirSync(join(validatedOutDir, 'charts'), { recursive: true });
+        const chartsDir = SecurityUtils.validatePath(join(validatedOutDir, 'charts'), process.cwd(), {
+            allowAbsolute: true,
+        });
+        mkdirSync(chartsDir, { recursive: true });
         for (const subchart of this.props.subcharts) {
             if (!SecurityUtils.isValidSubchartName(subchart.name)) {
                 throw new Error(`Invalid subchart name: ${SecurityUtils.sanitizeLogMessage(subchart.name)}`);
             }
             const sanitizedName = subchart.name;
-            const subchartDir = join(validatedOutDir, 'charts', sanitizedName);
+            const subchartDir = SecurityUtils.validatePath(join(validatedOutDir, 'charts', sanitizedName), process.cwd(), { allowAbsolute: true });
             subchart.rutter.write(subchartDir);
         }
         this.writeParentChart(validatedOutDir);
         this.writeParentValues(validatedOutDir);
-        mkdirSync(join(validatedOutDir, 'templates'), { recursive: true });
-        writeFileSync(join(validatedOutDir, 'templates', 'NOTES.txt'), this.generateNotesTemplate());
+        const templatesDir = SecurityUtils.validatePath(join(validatedOutDir, 'templates'), process.cwd(), { allowAbsolute: true });
+        mkdirSync(templatesDir, { recursive: true });
+        const notesPath = SecurityUtils.validatePath(join(validatedOutDir, 'templates', 'NOTES.txt'), process.cwd(), { allowAbsolute: true });
+        writeFileSync(notesPath, this.generateNotesTemplate());
     }
     writeParentChart(outDir) {
         const chartYaml = {
@@ -63,7 +68,10 @@ export class UmbrellaRutter {
                 };
             }),
         };
-        writeFileSync(join(outDir, 'Chart.yaml'), dumpHelmAwareYaml(chartYaml));
+        const chartYamlPath = SecurityUtils.validatePath(join(outDir, 'Chart.yaml'), process.cwd(), {
+            allowAbsolute: true,
+        });
+        writeFileSync(chartYamlPath, dumpHelmAwareYaml(chartYaml));
     }
     writeParentValues(outDir) {
         const values = {
@@ -77,12 +85,16 @@ export class UmbrellaRutter {
                 };
             }
         }
-        writeFileSync(join(outDir, 'values.yaml'), dumpHelmAwareYaml(values));
+        const valuesYamlPath = SecurityUtils.validatePath(join(outDir, 'values.yaml'), process.cwd(), {
+            allowAbsolute: true,
+        });
+        writeFileSync(valuesYamlPath, dumpHelmAwareYaml(values));
         if (this.props.envValues) {
             for (const [env, envVals] of Object.entries(this.props.envValues)) {
                 const sanitizedEnv = SecurityUtils.sanitizeEnvironmentName(env);
                 const envValues = this.deepMerge(values, envVals);
-                writeFileSync(join(outDir, `values-${sanitizedEnv}.yaml`), dumpHelmAwareYaml(envValues));
+                const envValuesPath = SecurityUtils.validatePath(join(outDir, `values-${sanitizedEnv}.yaml`), process.cwd(), { allowAbsolute: true });
+                writeFileSync(envValuesPath, dumpHelmAwareYaml(envValues));
             }
         }
     }

package/dist/lib/utils/envVarsLoader.js

@@ -1,22 +1,28 @@
 import { readFileSync, existsSync } from 'fs';
 import { join } from 'path';
 import { parse as parseYaml } from 'yaml';
+import { SecurityUtils } from '../security.js';
 import { createHelmExpression } from './helmControlStructures.js';
 export function loadEnvVarsConfig(options = {}) {
     const { configPath, fallbackConfig = [] } = options;
     try {
-        if (configPath && existsSync(configPath)) {
-            const data = readFileSync(configPath, 'utf-8');
-            return configPath.endsWith('.yaml') || configPath.endsWith('.yml')
-                ? parseYaml(data)
-                : JSON.parse(data);
+        if (configPath) {
+            const validatedConfigPath = SecurityUtils.validatePath(configPath, process.cwd(), {
+                allowAbsolute: true,
+            });
+            if (existsSync(validatedConfigPath)) {
+                const data = readFileSync(validatedConfigPath, 'utf-8');
+                return validatedConfigPath.endsWith('.yaml') || validatedConfigPath.endsWith('.yml')
+                    ? parseYaml(data)
+                    : JSON.parse(data);
+            }
         }
-        const yamlPath = join(process.cwd(), 'env-config.yaml');
+        const yamlPath = SecurityUtils.validatePath(join(process.cwd(), 'env-config.yaml'), process.cwd(), { allowAbsolute: true });
         if (existsSync(yamlPath)) {
             const data = readFileSync(yamlPath, 'utf-8');
             return parseYaml(data);
         }
-        const jsonPath = join(process.cwd(), 'env-config.json');
+        const jsonPath = SecurityUtils.validatePath(join(process.cwd(), 'env-config.json'), process.cwd(), { allowAbsolute: true });
         if (existsSync(jsonPath)) {
             const data = readFileSync(jsonPath, 'utf-8');
             return JSON.parse(data);

package/dist/lib/utils/helmHelpers.js

@@ -261,12 +261,20 @@ export const AWS_HELPERS = [
 ];
 export function formatHelpers(helpers) {
     return helpers
-        .map((helper) => `{{/*
+        .map((helper) => {
+        if (!helper.name || typeof helper.name !== 'string') {
+            throw new Error('Helper must have a valid name property');
+        }
+        if (!helper.template || typeof helper.template !== 'string') {
+            throw new Error(`Helper '${helper.name}' must have a valid template property`);
+        }
+        return `{{/*
 ${helper.name}
 */}}
 {{- define "${helper.name}" -}}
 ${helper.template}
-{{- end }}`)
+{{- end }}`;
+    })
         .join('\n\n');
 }
 export function getDefaultHelpers(cloudProvider, options) {