fix(util): strip special and control characters from app.name (#1259)

* This mitigates potential path traversal. Fixes: #1258 --------- Co-authored-by: Ayushman Chhabra <14110965+ayushmanchhabra@users.noreply.github.com>
nwutils · Oct 9, 2024 · b035bc3 · b035bc3
1 parent 9bfe70f
commit b035bc3
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 0 deletions.
diff --git a/eslint.config.js b/eslint.config.js
@@ -13,6 +13,7 @@ export default [
   jsdoc.configs['flat/recommended'],
   {
     rules: {
+      "no-control-regex": ["off"],
       "semi": ["error", "always"],
       "quotes": ["error", "single"],
     }

diff --git a/src/util.js b/src/util.js
@@ -202,6 +202,8 @@ export const parse = async (options, pkg) => {
 
   options.app = options.app ?? {};
   options.app.name = options.app.name ?? pkg.name;
+  /* Remove special and control characters from app.name to mitigate potential path traversal. */
+  options.app.name = options.app.name.replace(/[<>:"/\\|?*\u0000-\u001F]/g, '');
   options.app.icon = options.app.icon ?? undefined;
 
   // TODO(#737): move this out