mirror of
https://github.com/davila7/claude-code-templates.git
synced 2026-09-19 01:30:23 +08:00
spartan
bc4618b072
* Fix unauthenticated command injection (RCE) in Studio server
The `--studio` server (cli-tool/src/sandbox-server.js) bound to 0.0.0.0
with wildcard CORS and no authentication, and passed request-body fields
into spawn(..., { shell: true }). Because shell:true makes Node join the
argv array into a single `sh -c` string, the fields were parsed by the
shell, allowing OS command injection (RCE) via POST /api/execute (prompt)
and POST /api/install-agent (agentName), reachable from the LAN or a
malicious web page (wildcard CORS).
- Remove shell:true from all three spawns so arguments stay discrete argv
entries; shell metacharacters can no longer inject commands.
- Validate agentName against ^[A-Za-z0-9._/-]+$ before use.
- Bind the server to 127.0.0.1 only (removes the LAN vector).
- Restrict CORS to the local UI origin and reject cross-origin requests
(removes the drive-by browser vector).
Fixes GHSA-79wm-x847-7cvg.
Co-Authored-By: Claude Opus <noreply@anthropic.com>
* security: Windows-safe spawns + release bump on top of GHSA-79wm-x847-7cvg fix
Builds on @spartan8806's fix (advisory-fix-1). Adds the two pieces that fix
lacked:
- Resolve npx/claude via their .cmd shims on Windows (NPX_CMD/CLAUDE_CMD).
Without shell:true, bare spawn('npx'/'claude') fails with ENOENT on win32,
which would break agent install/local execution. This keeps the security fix
cross-platform.
- Bump version to 1.29.4 (root + cli-tool package.json) and add the 1.29.4
Security entry to CHANGELOG for the patched release.
Refs GHSA-79wm-x847-7cvg.
---------
Co-authored-by: spartan8806 <spartan8806@users.noreply.github.com>
Co-authored-by: Claude Opus <noreply@anthropic.com>
Co-authored-by: Dani <dan.avila7@gmail.com>
110 lines
3.2 KiB
JSON
110 lines
3.2 KiB
JSON
{
|
|
"name": "claude-code-templates",
|
|
"version": "1.29.4",
|
|
"description": "CLI tool to setup Claude Code configurations with framework-specific commands, automation hooks and MCP Servers for your projects",
|
|
"main": "src/index.js",
|
|
"bin": {
|
|
"create-claude-config": "bin/create-claude-config.js",
|
|
"claude-code-templates": "bin/create-claude-config.js",
|
|
"claude-code-template": "bin/create-claude-config.js",
|
|
"claude-init": "bin/create-claude-config.js",
|
|
"cctemplates": "bin/create-claude-config.js",
|
|
"cct": "bin/create-claude-config.js",
|
|
"claude-setup": "bin/create-claude-config.js",
|
|
"claude-config": "bin/create-claude-config.js"
|
|
},
|
|
"scripts": {
|
|
"start": "node bin/create-claude-config.js",
|
|
"build:ui": "cd analytics-ui && npm install && npm run build",
|
|
"dev:ui": "cd analytics-ui && npm run dev",
|
|
"prepublishOnly": "npm run build:ui && npm test",
|
|
"test": "jest",
|
|
"test:watch": "jest --watch",
|
|
"test:coverage": "jest --coverage",
|
|
"test:unit": "jest tests/unit",
|
|
"test:integration": "jest tests/integration",
|
|
"test:e2e": "jest tests/e2e",
|
|
"test:analytics": "jest --testPathPattern=analytics",
|
|
"test:commands": "./test-commands.sh",
|
|
"test:detailed": "./test-detailed.sh",
|
|
"test:react": "make test-react",
|
|
"test:vue": "make test-vue",
|
|
"test:node": "make test-node",
|
|
"test:all": "npm run test:coverage && make test",
|
|
"dev:link": "npm link",
|
|
"dev:unlink": "npm unlink -g claude-code-templates",
|
|
"pretest:commands": "npm run dev:link",
|
|
"analytics:start": "node src/analytics.js",
|
|
"analytics:test": "npm run test:analytics",
|
|
"security-audit": "node src/security-audit.js",
|
|
"security-audit:ci": "node src/security-audit.js --ci",
|
|
"security-audit:verbose": "node src/security-audit.js --verbose",
|
|
"security-audit:json": "node src/security-audit.js --json --output=security-report.json"
|
|
},
|
|
"keywords": [
|
|
"claude",
|
|
"claude-code",
|
|
"ai",
|
|
"configuration",
|
|
"template",
|
|
"setup",
|
|
"cli",
|
|
"hooks",
|
|
"automation",
|
|
"javascript",
|
|
"typescript",
|
|
"react",
|
|
"vue",
|
|
"angular",
|
|
"nodejs",
|
|
"python",
|
|
"django",
|
|
"flask",
|
|
"fastapi",
|
|
"rust",
|
|
"go"
|
|
],
|
|
"author": "Claude Code Templates",
|
|
"license": "MIT",
|
|
"dependencies": {
|
|
"@clack/prompts": "^1.5.1",
|
|
"boxen": "^5.1.2",
|
|
"chalk": "^4.1.2",
|
|
"chokidar": "^3.5.3",
|
|
"commander": "^11.1.0",
|
|
"express": "^4.18.2",
|
|
"fs-extra": "^11.1.1",
|
|
"gradient-string": "^2.0.2",
|
|
"inquirer": "^8.2.6",
|
|
"js-yaml": "^4.1.0",
|
|
"open": "^8.4.2",
|
|
"ora": "^5.4.1",
|
|
"qrcode": "^1.5.3",
|
|
"uuid": "^11.1.0",
|
|
"ws": "^8.18.3"
|
|
},
|
|
"engines": {
|
|
"node": ">=14.0.0"
|
|
},
|
|
"repository": {
|
|
"type": "git",
|
|
"url": "git+https://github.com/davila7/claude-code-templates.git"
|
|
},
|
|
"bugs": {
|
|
"url": "https://github.com/davila7/claude-code-templates/issues"
|
|
},
|
|
"homepage": "https://github.com/davila7/claude-code-templates#readme",
|
|
"files": [
|
|
"bin/",
|
|
"src/",
|
|
"components/sandbox/e2b/",
|
|
"components/sandbox/cloudflare/",
|
|
"components/sandbox/docker/",
|
|
"README.md"
|
|
],
|
|
"devDependencies": {
|
|
"jest": "^30.0.4",
|
|
"jest-watch-typeahead": "^3.0.1"
|
|
}
|
|
}
|