DX - 399 - SRE issues fixes

package.json

@@ -99,4 +99,4 @@
       "app:uninstall": "APUI"
     }
   }
-}
+}

src/commands/app/create.ts

@@ -31,6 +31,7 @@ import {
   getAppName,
   getDirName,
   getOrgAppUiLocation,
+  sanitizePath
 } from "../../util";
 
 export default class Create extends BaseCommand<typeof Create> {
@@ -386,7 +387,7 @@ export default class Create extends BaseCommand<typeof Create> {
 
     this.sharedConfig.folderPath = resolve(
       dirname(this.sharedConfig.folderPath),
-      this.appData.name
+      sanitizePath(this.appData.name)
     );
     this.sharedConfig.nameChanged = true;
 

src/util/common-utils.ts

@@ -225,6 +225,10 @@ async function fetchInstalledApps(
   return batchRequests.flat();
 }
 
+
+// To remove the relative path 
+const sanitizePath = (str: string) => str?.replace(/^(\.\.(\/|\\|$))+/, '');
+
 export {
   getOrganizations,
   getOrgAppUiLocation,
@@ -237,4 +241,5 @@ export {
   fetchStack,
   uninstallApp,
   fetchInstalledApps,
+  sanitizePath
 };

src/util/fs.ts

@@ -1,21 +1,22 @@
 import { existsSync, readdirSync, writeFileSync, mkdirSync } from "fs";
 import { resolve } from "path";
 import config from "../config";
-import messages, {$t} from "../messages";
+import messages, { $t } from "../messages";
 import { LogFn } from "../types";
 import { cliux } from "@contentstack/cli-utilities";
+import { sanitizePath } from './common-utils'
 
-export async function writeFile(dir: string=process.cwd(), force: boolean=false, data: Record<string, any> | undefined={}, log: LogFn=console.log) {
+export async function writeFile(dir: string = process.cwd(), force: boolean = false, data: Record<string, any> | undefined = {}, log: LogFn = console.log) {
   await ensureDirectoryExists(dir)
   const files = readdirSync(dir)
   const latestFileName = files.filter(fileName => fileName.match(new RegExp(config.defaultAppFileName))).pop()?.split('.')[0] || config.defaultAppFileName;
-  let target = resolve(dir, `${latestFileName}.json`)
+  let target = resolve(sanitizePath(dir), `${sanitizePath(latestFileName)}.json`)
   if (existsSync(target)) {
     const userConfirmation: boolean = force || (await cliux.confirm($t(messages.FILE_ALREADY_EXISTS, { file: `${config.defaultAppFileName}.json` })))
     if (userConfirmation) {
-      target = resolve(dir, `${config.defaultAppFileName}.json`);
+      target = resolve(sanitizePath(dir), `${sanitizePath(config.defaultAppFileName)}.json`);
     } else {
-      target = resolve(dir, `${incrementName(latestFileName)}.json`);
+      target = resolve(sanitizePath(dir), `${sanitizePath(incrementName(latestFileName))}.json`);
     }
   }
   await writeFileSync(target, JSON.stringify(data))
@@ -24,10 +25,10 @@ export async function writeFile(dir: string=process.cwd(), force: boolean=false,
 
 async function ensureDirectoryExists(dir: string) {
   if (!existsSync(dir)) {
-    await mkdirSync(dir, {recursive: true})
+    await mkdirSync(dir, { recursive: true })
   }
 }
 
 function incrementName(name: string) {
-  return `${config.defaultAppFileName}${Number(name.split(config.defaultAppFileName).pop())+1}`
+  return `${config.defaultAppFileName}${Number(name.split(config.defaultAppFileName).pop()) + 1}`
 }

src/util/inquirer.ts

@@ -20,6 +20,7 @@ import {
   fetchAppInstallations,
   fetchInstalledApps,
   fetchApps,
+  sanitizePath,
 } from "./common-utils";
 
 /**
@@ -64,14 +65,14 @@ async function getDirName(path: string): Promise<string> {
           return $t(errors.INVALID_NAME, { min: "3", max: "50" });
         }
 
-        if (existsSync(join(basePath, name))) {
+        if (existsSync(join(sanitizePath(basePath), sanitizePath(name)))) {
           return messages.DIR_EXIST;
         }
 
         return true;
       },
     })
-    .then((name) => join(basePath, name as string));
+    .then((name) => join(sanitizePath(basePath), sanitizePath(name as string)));
 }
 
 /**