daffy0208 a79b1d2512 fix: CRITICAL security fixes and runtime error corrections ...

PHASE 1: SECURITY FIXES (9 CRITICAL issues resolved)
========================================================

1. Path Traversal Protection (ALL generators)
   - Created shared validation utility (CLI/utils/validation.js)
   - Added sanitizeName() to prevent directory traversal attacks
   - Validates all user input before file path generation
   - Blocks: "../", absolute paths, hidden files, invalid characters
   - Affects: component, integration, mcp, tool, project generators

2. Code Injection Prevention (ALL generators)
   - validateIdentifier() checks for valid JS/TS identifiers
   - validatePythonIdentifier() for Python tools
   - Blocks reserved keywords and invalid syntax
   - Prevents injection via prop names, class names, identifiers

3. Silent Overwrite Protection (add.js)
   - Created writeFilesWithCheck() helper function
   - Prompts user before overwriting existing files
   - Prevents accidental data loss
   - Applies to all generator outputs

PHASE 2: RUNTIME ERROR FIXES (7 HIGH issues resolved)
========================================================

4. CrewAI File Extension Fix (tool-generator.js)
   - CrewAI tools now correctly save as .py (not .ts)
   - Added datetime import to Python templates
   - Framework validation prevents invalid choices

5. MCP Server Destructuring Bugs (mcp-generator.js:119, 234)
   - Fixed null pointer exceptions in tool/prompt handlers
   - Added ?? {} fallback for missing arguments
   - Prevents server crashes on malformed requests

6. Integration 204 Response Handling (integration-generator.js)
   - DELETE requests properly handle 204 No Content
   - Checks content-length header before JSON parse
   - Returns null instead of throwing errors

7. Integration Types Import Fix (integration-generator.js)
   - Only exports types when withTypes=true
   - Prevents import errors when types file missing
   - Added conditional type generation logic

8. Component Test Failures Fix (component-generator.js)
   - Removed className test (components don't support it)
   - Tests now pass on first run
   - Added documentation comment for className support

9. CLI Async Handling Fix (index.js:198)
   - Changed parse() to parseAsync() for async commands
   - Wrapped in main() with proper error handling
   - Prevents UnhandledPromiseRejectionWarning

10. Add Command Validation (add.js)
    - Integrated validation utilities in add command
    - All generators receive sanitized inputs
    - User-friendly error messages for invalid input

SECURITY IMPACT
================
- Prevents arbitrary file writes (path traversal)
- Blocks code injection attacks
- Eliminates silent data overwrites
- Validates all user input at entry points
- Follows OWASP security best practices

TESTING
=======
- Manual testing of all generators with malicious input
- Verified error handling and validation messages
- Confirmed file overwrite prompts work correctly
- All fixes validated against Codex review findings

Fixes identified by: Codex CLI automated security review
Review document: META/COMPREHENSIVE-CODEX-REVIEW.md (40 total issues)
Status: 16/40 issues fixed (Phase 1 & 2 complete)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

2025-10-27 11:44:23 +00:00

..

github-fetch.js

feat: Complete registry system synchronization and file dependency tracking

2025-10-24 19:49:21 +01:00

validation.js

fix: CRITICAL security fixes and runtime error corrections

2025-10-27 11:44:23 +00:00