@@ -26,21 +26,28 @@ test("shell escaping with quote function", () => {
2626test ( "autorest command construction with dangerous inputs" , ( ) => {
2727 // Simulate the command construction logic from processViaAutoRest
2828 const autoRestPath = "/usr/bin/autorest"
29-
29+
3030 // Test with dangerous file paths
3131 const dangerousSwaggerPath = "/tmp/file;rm -rf /.json"
3232 const dangerousOutputFile = "output;evil&command"
3333 const dangerousTag = "tag$(evil)"
3434
3535 // Build command like in processViaAutoRest with escaping
36- const autoRestCmd = autoRestPath + " " + quote ( [ dangerousSwaggerPath ] ) + " --v2 --tag=" + quote ( [ dangerousTag ] ) + " --output-artifact=swagger-document.json --output-artifact=swagger-document.map --output-file=" + quote ( [ dangerousOutputFile ] )
36+ const autoRestCmd =
37+ autoRestPath +
38+ " " +
39+ quote ( [ dangerousSwaggerPath ] ) +
40+ " --v2 --tag=" +
41+ quote ( [ dangerousTag ] ) +
42+ " --output-artifact=swagger-document.json --output-artifact=swagger-document.map --output-file=" +
43+ quote ( [ dangerousOutputFile ] )
3744
3845 // Verify that dangerous parts are properly escaped/quoted
3946 // Files with spaces get quoted, dangerous chars get backslash-escaped
4047 assert . ok ( autoRestCmd . includes ( "'/tmp/file;rm -rf /.json'" ) ) // quoted because of spaces
4148 assert . ok ( autoRestCmd . includes ( "output\\;evil\\&command" ) ) // backslash-escaped
4249 assert . ok ( autoRestCmd . includes ( "tag\\$\\(evil\\)" ) ) // backslash-escaped
43-
50+
4451 // Verify that the command structure is maintained
4552 assert . ok ( autoRestCmd . includes ( "--v2" ) )
4653 assert . ok ( autoRestCmd . includes ( "--tag=" ) )
@@ -54,14 +61,15 @@ test("autorest command construction without tag", () => {
5461 const outputFolder = "/tmp/output folder"
5562
5663 // Build command without tag (different structure)
57- const autoRestCmd = `${ autoRestPath } --v2 --input-file=${ quote ( [ swaggerPath ] ) } --output-artifact=swagger-document.json` +
64+ const autoRestCmd =
65+ `${ autoRestPath } --v2 --input-file=${ quote ( [ swaggerPath ] ) } --output-artifact=swagger-document.json` +
5866 ` --output-artifact=swagger-document.map --output-file=${ quote ( [ outputFile ] ) } --output-folder=${ quote ( [ outputFolder ] ) } `
5967
6068 // Verify correct command structure for non-tagged case
6169 assert . ok ( autoRestCmd . includes ( "--input-file=" ) )
6270 assert . ok ( ! autoRestCmd . includes ( "--tag=" ) )
6371 assert . ok ( autoRestCmd . includes ( "--v2" ) )
64-
72+
6573 // Verify spaces are properly quoted
6674 assert . ok ( autoRestCmd . includes ( "'/tmp/test file.json'" ) )
6775 assert . ok ( autoRestCmd . includes ( "'output file'" ) )
@@ -91,16 +99,16 @@ test("command injection prevention", () => {
9199test ( "edge cases and special characters" , ( ) => {
92100 // Test empty string
93101 assert . strictEqual ( quote ( [ "" ] ) , "''" )
94-
102+
95103 // Test string with only spaces
96104 assert . strictEqual ( quote ( [ " " ] ) , "' '" )
97-
105+
98106 // Test string with newlines
99107 const withNewlines = "file\nwith\nnewlines.json"
100108 const escapedNewlines = quote ( [ withNewlines ] )
101109 // Should be safely handled
102110 assert . ok ( typeof escapedNewlines === "string" )
103-
111+
104112 // Test unicode and special chars
105113 const unicodeFile = "файл.json"
106114 const escapedUnicode = quote ( [ unicodeFile ] )
0 commit comments