ros/automaker
1
0
Fork 0
mirror of https://github.com/AutoMaker-Org/automaker.git synced 2026-03-21 23:33:07 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: Improve error handling and validation across multiple services

Browse Source
This commit is contained in:
gsxdsm
2026-02-18 22:11:31 -08:00
parent 53d07fefb8
commit 205f662022
17 changed files with 395 additions and 339 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
apps/server/src/routes/worktree/common.ts
View File

@@ -62,13 +62,21 @@ export const execEnv = {
/**
* Validate git remote name to prevent command injection.
* Allowed characters: alphanumerics, hyphen, underscore, dot, and slash.
* Rejects empty strings and names that are too long.
* Matches the strict validation used in add-remote.ts:
* - Rejects empty strings and names that are too long
* - Disallows names that start with '-' or '.'
* - Forbids the substring '..'
* - Rejects '/' characters
* - Rejects NUL bytes
* - Must consist only of alphanumerics, hyphens, underscores, and dots
*/
export function isValidRemoteName(name: string): boolean {
return (
name.length > 0 && name.length < MAX_BRANCH_NAME_LENGTH && /^[a-zA-Z0-9._\-/]+$/.test(name)
);
if (!name || name.length === 0 || name.length >= MAX_BRANCH_NAME_LENGTH) return false;
if (name.startsWith('-') || name.startsWith('.')) return false;
if (name.includes('..')) return false;
if (name.includes('/')) return false;
if (name.includes('\0')) return false;
return /^[a-zA-Z0-9._-]+$/.test(name);
}
/**