u2a 3.3.1 → 3.4.1

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "u2a",
-    "version": "3.3.1",
+    "version": "3.4.1",
     "description": "URL to App - Turn any URL into a desktop application",
     "main": "src/index.js",
     "bin": {

package/src/commands/create.js

@@ -1,12 +1,12 @@
 const fs = require('fs');
 const path = require('path');
-const { execSync } = require('child_process');
 const { normalizeUrl, getDomainName } = require('../utils/url');
 const { getFavicon, processFavicon } = require('../utils/favicon');
 const { APPS_DIR, readDB, writeDB } = require('../utils/config');
 const Logger = require('../utils/logger');
 const os = require('os');
 const { sanitizeInput } = require('../utils/sanitize');
+const { secureExec } = require('../utils/securexec');
 
 const logger = new Logger('create');
 
@@ -38,7 +38,7 @@ function createWindowsShortcut(appInfo) {
     const tempScriptPath = path.join(os.tmpdir(), `create_shortcut_${appName}.ps1`);
     fs.writeFileSync(tempScriptPath, psScript);
 
-    execSync(`powershell -ExecutionPolicy Bypass -File "${tempScriptPath}"`, {
+    secureExec(`powershell -ExecutionPolicy Bypass -File "${tempScriptPath}"`, {
       stdio: ['ignore', 'pipe', 'pipe'],
       windowsHide: true
     });
@@ -555,7 +555,7 @@ async function buildExecutable(appDir, appName, platform, iconPath, options) {
       windowsHide: true
     };
     
-    execSync('npm install --save-dev electron-packager electron', installOptions);
+    secureExec('npm install --save-dev electron-packager electron', installOptions);
     
     let platformFlag = '';
     let archFlag = `--arch=${options.arch || 'x64'}`;
@@ -585,7 +585,7 @@ async function buildExecutable(appDir, appName, platform, iconPath, options) {
     
     logger.debug(`Executing: ${packageCommand}`);
     
-    execSync(packageCommand, installOptions);
+    secureExec(packageCommand, installOptions);
     
     let distPlatform = '';
     switch(platform) {
@@ -631,7 +631,7 @@ async function buildSetup(appDir, platform, arch) {
       windowsHide: true
     };
     
-    execSync('npm install --save-dev electron-builder', installOptions);
+    secureExec('npm install --save-dev electron-builder', installOptions);
     
     let builderArgs = '';
     switch(platform) {
@@ -654,7 +654,7 @@ async function buildSetup(appDir, platform, arch) {
     
     const builderCommand = `npx electron-builder ${builderArgs}`;
     logger.debug(`Executing: ${builderCommand}`);
-    execSync(builderCommand, installOptions);
+    secureExec(builderCommand, installOptions);
     
     const installerPath = path.join(appDir, 'installer');
     if (fs.existsSync(installerPath)) {
@@ -712,7 +712,7 @@ async function createApp(url, options) {
       windowsHide: true
     };
 
-    execSync('npm install --only=prod', installOptions);
+    secureExec('npm install --only=prod', installOptions);
     logger.debug(`npm install completed`);
 
     let executablePath = null;

package/src/utils/sanitize.js

@@ -1,7 +1,21 @@
+const Logger = require('./logger');
+const logger = new Logger('sanitize');
+
+
 function sanitizeInput(userInput) {
-    return userInput.replace(/[^a-zA-Z0-9_-\s.]/g, '_');
+    const sInput = userInput.replace(/[^a-zA-Z0-9_\-.\s:/@%]/g, '_');
+    logger.debug(`Original content: ${userInput} | Sanitized content: ${sInput}`);
+    return sInput;
 }
 
+function sanitizeCommand(command) {
+    const sCommand = command.replace(/[^\w\-.:/@\\ ="']/g, '_');
+    logger.debug(`Original content: ${command} | Sanitized content: ${sCommand}`);
+    return sCommand;
+}
+
+
 module.exports = {
-    sanitizeInput
+    sanitizeInput,
+    sanitizeCommand
 }

package/src/utils/securexec.js

@@ -0,0 +1,13 @@
+const { execSync } = require('child_process');
+const { sanitizeCommand } = require('./sanitize');
+
+function secureExec(command, options = {}) {
+    const sanitizedCommand = sanitizeCommand(command);
+    const result = execSync(sanitizedCommand, options);
+
+    return result;
+  }
+  
+module.exports = {
+    secureExec
+}

package/src/utils/url.js

@@ -1,4 +1,5 @@
 const axios = require('axios');
+const { sanitizeInput } = require('./sanitize');
 
 async function normalizeUrl(url) {
   if (!url.startsWith('http://') && !url.startsWith('https://')) {
@@ -9,7 +10,7 @@ async function normalizeUrl(url) {
       url = 'http://' + url;
     }
   }
-  return url;
+  return sanitizeInput(url);
 }
 
 function getDomainName(url) {
@@ -17,7 +18,7 @@ function getDomainName(url) {
     const { hostname } = new URL(url);
     return hostname.replace(/^www\./, '');
   } catch (error) {
-    return url;
+    return sanitizeInput(url);
   }
 }