mirror of
https://github.com/davila7/claude-code-templates.git
synced 2026-09-19 01:30:23 +08:00
spartan
bc4618b072
* Fix unauthenticated command injection (RCE) in Studio server
The `--studio` server (cli-tool/src/sandbox-server.js) bound to 0.0.0.0
with wildcard CORS and no authentication, and passed request-body fields
into spawn(..., { shell: true }). Because shell:true makes Node join the
argv array into a single `sh -c` string, the fields were parsed by the
shell, allowing OS command injection (RCE) via POST /api/execute (prompt)
and POST /api/install-agent (agentName), reachable from the LAN or a
malicious web page (wildcard CORS).
- Remove shell:true from all three spawns so arguments stay discrete argv
entries; shell metacharacters can no longer inject commands.
- Validate agentName against ^[A-Za-z0-9._/-]+$ before use.
- Bind the server to 127.0.0.1 only (removes the LAN vector).
- Restrict CORS to the local UI origin and reject cross-origin requests
(removes the drive-by browser vector).
Fixes GHSA-79wm-x847-7cvg.
Co-Authored-By: Claude Opus <noreply@anthropic.com>
* security: Windows-safe spawns + release bump on top of GHSA-79wm-x847-7cvg fix
Builds on @spartan8806's fix (advisory-fix-1). Adds the two pieces that fix
lacked:
- Resolve npx/claude via their .cmd shims on Windows (NPX_CMD/CLAUDE_CMD).
Without shell:true, bare spawn('npx'/'claude') fails with ENOENT on win32,
which would break agent install/local execution. This keeps the security fix
cross-platform.
- Bump version to 1.29.4 (root + cli-tool package.json) and add the 1.29.4
Security entry to CHANGELOG for the patched release.
Refs GHSA-79wm-x847-7cvg.
---------
Co-authored-by: spartan8806 <spartan8806@users.noreply.github.com>
Co-authored-by: Claude Opus <noreply@anthropic.com>
Co-authored-by: Dani <dan.avila7@gmail.com>
62 lines
1.6 KiB
JSON
62 lines
1.6 KiB
JSON
{
|
|
"name": "claude-code-templates",
|
|
"version": "1.29.4",
|
|
"description": "Component templates and tracking system for Claude Code",
|
|
"main": "cli-tool/src/index.js",
|
|
"bin": {
|
|
"claude-code-templates": "cli-tool/bin/create-claude-config.js",
|
|
"cct": "cli-tool/bin/create-claude-config.js"
|
|
},
|
|
"scripts": {
|
|
"dev": "vercel dev",
|
|
"build": "echo 'Build complete'",
|
|
"start": "vercel dev",
|
|
"test": "echo 'No tests specified'",
|
|
"agent:security-auditor": "security-auditor 'Security audit covering codebase, dependencies, and deployment configuration'",
|
|
"deploy": "./scripts/deploy.sh",
|
|
"deploy:dashboard": "./scripts/deploy.sh",
|
|
"discord:register": "node api/discord/register-commands.cjs"
|
|
},
|
|
"dependencies": {
|
|
"@clack/prompts": "^1.5.1",
|
|
"@supabase/supabase-js": "^2.39.0",
|
|
"@vercel/postgres": "^0.10.0",
|
|
"axios": "^1.6.2",
|
|
"boxen": "^5.1.2",
|
|
"chalk": "^4.1.2",
|
|
"chokidar": "^3.5.3",
|
|
"commander": "^11.1.0",
|
|
"discord-interactions": "^3.4.0",
|
|
"dotenv": "^16.3.1",
|
|
"express": "^4.18.2",
|
|
"fs-extra": "^11.1.1",
|
|
"gradient-string": "^2.0.2",
|
|
"inquirer": "^8.2.6",
|
|
"js-yaml": "^4.1.1",
|
|
"open": "^8.4.2",
|
|
"ora": "^5.4.1",
|
|
"qrcode": "^1.5.4",
|
|
"uuid": "^11.1.0",
|
|
"ws": "^8.18.3"
|
|
},
|
|
"devDependencies": {
|
|
"@vercel/node": "^3.0.0"
|
|
},
|
|
"keywords": [
|
|
"claude-code",
|
|
"templates",
|
|
"components",
|
|
"tracking",
|
|
"analytics"
|
|
],
|
|
"author": "Claude Code Templates",
|
|
"license": "MIT",
|
|
"files": [
|
|
"cli-tool/bin/",
|
|
"cli-tool/src/",
|
|
"cli-tool/components/sandbox/",
|
|
"cli-tool/package.json",
|
|
"README.md"
|
|
]
|
|
}
|