ewilliams28/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-08-26 12:26:38 -06:00
Code Issues Packages Projects Releases Wiki Activity

fix(release): reject unsafe candidate pack names

Browse Source
This commit is contained in:
Vincent Koc
2026-06-17 03:19:03 +02:00
parent b338a68e57
commit 5b077d549e
2 changed files with 93 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/scripts/resolve-openclaw-package-candidate.test.ts
+52
View File
@@ -12,6 +12,7 @@ import {
downloadUrl,
findSingleTarballForTest,
loadTrustedPackageSource,
moveNewestPackedTarballForTest,
parseArgs,
readArtifactPackageCandidateMetadata,
readPackageBuildSourceSha,
@@ -211,6 +212,57 @@ describe("resolve-openclaw-package-candidate", () => {
});
});
it("keeps npm pack filenames inside the package candidate output directory", async () => {
const dir = await mkdtemp(path.join(tmpdir(), "openclaw-package-npm-pack-"));
tempDirs.push(dir);
await writeFile(path.join(dir, "openclaw-2026.6.17.tgz"), "package");
await expect(
moveNewestPackedTarballForTest(
dir,
JSON.stringify([{ filename: "openclaw-2026.6.17.tgz" }]),
"openclaw-current.tgz",
),
).resolves.toBe(path.join(dir, "openclaw-current.tgz"));
await expect(readFile(path.join(dir, "openclaw-current.tgz"), "utf8")).resolves.toBe("package");
});
it("rejects path-like npm pack filenames instead of renaming outside the output directory", async () => {
const dir = await mkdtemp(path.join(tmpdir(), "openclaw-package-npm-pack-"));
tempDirs.push(dir);
const unsafeFilenames = [
"../openclaw-2026.6.17.tgz",
"nested/openclaw-2026.6.17.tgz",
"nested\\openclaw-2026.6.17.tgz",
"/tmp/openclaw-2026.6.17.tgz",
"C:\\temp\\openclaw-2026.6.17.tgz",
"openclaw-2026.6.17.tar.gz",
];
for (const filename of unsafeFilenames) {
await expect(
moveNewestPackedTarballForTest(dir, JSON.stringify([{ filename }]), "openclaw-current.tgz"),
).rejects.toThrow("npm pack reported unsafe OpenClaw tarball filename");
}
});
it("rejects unsafe text npm pack filenames instead of using loose stdout fallback", async () => {
const dir = await mkdtemp(path.join(tmpdir(), "openclaw-package-npm-pack-"));
tempDirs.push(dir);
await writeFile(path.join(dir, "openclaw-2026.6.17.tgz"), "safe fallback");
for (const filename of ["../openclaw-2026.6.17.tgz", "C:openclaw-2026.6.17.tgz"]) {
await expect(
moveNewestPackedTarballForTest(
dir,
["npm notice", filename].join("\n"),
"openclaw-current.tgz",
),
).rejects.toThrow("npm pack reported unsafe OpenClaw tarball filename");
}
});
it("bounds captured command stderr tails on failures", async () => {
await expect(
runCommandForTest(