u2a 3.3.0 → 3.4.1

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "u2a",
-    "version": "3.3.0",
+    "version": "3.4.1",
     "description": "URL to App - Turn any URL into a desktop application",
     "main": "src/index.js",
     "bin": {

package/src/commands/create.js

@@ -1,14 +1,16 @@
 const fs = require('fs');
 const path = require('path');
-const { execSync } = require('child_process');
 const { normalizeUrl, getDomainName } = require('../utils/url');
 const { getFavicon, processFavicon } = require('../utils/favicon');
 const { APPS_DIR, readDB, writeDB } = require('../utils/config');
 const Logger = require('../utils/logger');
 const os = require('os');
+const { sanitizeInput } = require('../utils/sanitize');
+const { secureExec } = require('../utils/securexec');
 
 const logger = new Logger('create');
 
+
 function createWindowsShortcut(appInfo) {
   try {
     const { appName, appDir, iconPath } = appInfo;
@@ -36,7 +38,7 @@ function createWindowsShortcut(appInfo) {
     const tempScriptPath = path.join(os.tmpdir(), `create_shortcut_${appName}.ps1`);
     fs.writeFileSync(tempScriptPath, psScript);
 
-    execSync(`powershell -ExecutionPolicy Bypass -File "${tempScriptPath}"`, {
+    secureExec(`powershell -ExecutionPolicy Bypass -File "${tempScriptPath}"`, {
       stdio: ['ignore', 'pipe', 'pipe'],
       windowsHide: true
     });
@@ -553,7 +555,7 @@ async function buildExecutable(appDir, appName, platform, iconPath, options) {
       windowsHide: true
     };
     
-    execSync('npm install --save-dev electron-packager electron', installOptions);
+    secureExec('npm install --save-dev electron-packager electron', installOptions);
     
     let platformFlag = '';
     let archFlag = `--arch=${options.arch || 'x64'}`;
@@ -583,7 +585,7 @@ async function buildExecutable(appDir, appName, platform, iconPath, options) {
     
     logger.debug(`Executing: ${packageCommand}`);
     
-    execSync(packageCommand, installOptions);
+    secureExec(packageCommand, installOptions);
     
     let distPlatform = '';
     switch(platform) {
@@ -629,7 +631,7 @@ async function buildSetup(appDir, platform, arch) {
       windowsHide: true
     };
     
-    execSync('npm install --save-dev electron-builder', installOptions);
+    secureExec('npm install --save-dev electron-builder', installOptions);
     
     let builderArgs = '';
     switch(platform) {
@@ -652,7 +654,7 @@ async function buildSetup(appDir, platform, arch) {
     
     const builderCommand = `npx electron-builder ${builderArgs}`;
     logger.debug(`Executing: ${builderCommand}`);
-    execSync(builderCommand, installOptions);
+    secureExec(builderCommand, installOptions);
     
     const installerPath = path.join(appDir, 'installer');
     if (fs.existsSync(installerPath)) {
@@ -673,8 +675,8 @@ async function createApp(url, options) {
 
   try {
     url = await normalizeUrl(url);
-    const domain = getDomainName(url);
-    const appName = options.name || domain;
+    const domain = sanitizeInput(getDomainName(url));
+    const appName = sanitizeInput(options.name || domain);
 
     const db = readDB();
     if (db.hasOwnProperty(appName)) {
@@ -710,7 +712,7 @@ async function createApp(url, options) {
       windowsHide: true
     };
 
-    execSync('npm install --only=prod', installOptions);
+    secureExec('npm install --only=prod', installOptions);
     logger.debug(`npm install completed`);
 
     let executablePath = null;

package/src/commands/remove.js

@@ -1,14 +1,14 @@
 const fs = require('fs');
 const inquirer = require('inquirer');
-const { normalizeUrl, getDomainName } = require('../utils/url');
 const { readDB, writeDB, APPS_DIR } = require('../utils/config');
 const Logger = require('../utils/logger');
 const { removeAppFromOS } = require('./create');
 const path = require('path');
+const { sanitizeInput } = require('../utils/sanitize');
 
 const logger = new Logger('remove');
 
-async function removeApp(appName) {
+async function processRemoval(appName) {
   try {
     const db = readDB();
 
@@ -53,6 +53,11 @@ async function removeApp(appName) {
   }
 }
 
+async function removeApp(appName) {
+  const sAppName = sanitizeInput(appName);
+  await processRemoval(sAppName);
+}
+
 module.exports = {
   removeApp
 };

package/src/utils/sanitize.js

@@ -0,0 +1,21 @@
+const Logger = require('./logger');
+const logger = new Logger('sanitize');
+
+
+function sanitizeInput(userInput) {
+    const sInput = userInput.replace(/[^a-zA-Z0-9_\-.\s:/@%]/g, '_');
+    logger.debug(`Original content: ${userInput} | Sanitized content: ${sInput}`);
+    return sInput;
+}
+
+function sanitizeCommand(command) {
+    const sCommand = command.replace(/[^\w\-.:/@\\ ="']/g, '_');
+    logger.debug(`Original content: ${command} | Sanitized content: ${sCommand}`);
+    return sCommand;
+}
+
+
+module.exports = {
+    sanitizeInput,
+    sanitizeCommand
+}

package/src/utils/securexec.js

@@ -0,0 +1,13 @@
+const { execSync } = require('child_process');
+const { sanitizeCommand } = require('./sanitize');
+
+function secureExec(command, options = {}) {
+    const sanitizedCommand = sanitizeCommand(command);
+    const result = execSync(sanitizedCommand, options);
+
+    return result;
+  }
+  
+module.exports = {
+    secureExec
+}

package/src/utils/url.js

@@ -1,4 +1,5 @@
 const axios = require('axios');
+const { sanitizeInput } = require('./sanitize');
 
 async function normalizeUrl(url) {
   if (!url.startsWith('http://') && !url.startsWith('https://')) {
@@ -9,7 +10,7 @@ async function normalizeUrl(url) {
       url = 'http://' + url;
     }
   }
-  return url;
+  return sanitizeInput(url);
 }
 
 function getDomainName(url) {
@@ -17,7 +18,7 @@ function getDomainName(url) {
     const { hostname } = new URL(url);
     return hostname.replace(/^www\./, '');
   } catch (error) {
-    return url;
+    return sanitizeInput(url);
   }
 }