Merge pull request #1833 from contentstack/fix/path

cs-raj · web-flow · commit 40e4d25183ec · 2025-03-27T18:19:02.000+05:30
path fix
diff --git a/package-lock.json b/package-lock.json
diff --git a/packages/contentstack-audit/README.md b/packages/contentstack-audit/README.md
@@ -19,7 +19,7 @@ $ npm install -g @contentstack/cli-audit
 $ csdx COMMAND
 running command...
 $ csdx (--version|-v)
-@contentstack/cli-audit/1.9.0 darwin-arm64 node-v22.14.0
+@contentstack/cli-audit/1.9.1 darwin-arm64 node-v22.14.0
 $ csdx --help [COMMAND]
 USAGE
   $ csdx COMMAND
diff --git a/packages/contentstack-audit/package.json b/packages/contentstack-audit/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@contentstack/cli-audit",
-  "version": "1.9.0",
+  "version": "1.9.1",
   "description": "Contentstack audit plugin",
   "author": "Contentstack CLI",
   "homepage": "https://github.com/contentstack/cli",
diff --git a/packages/contentstack-auth/README.md b/packages/contentstack-auth/README.md
@@ -18,7 +18,7 @@ $ npm install -g @contentstack/cli-auth
 $ csdx COMMAND
 running command...
 $ csdx (--version)
-@contentstack/cli-auth/1.3.24 darwin-arm64 node-v22.14.0
+@contentstack/cli-auth/1.3.25 darwin-arm64 node-v22.14.0
 $ csdx --help [COMMAND]
 USAGE
   $ csdx COMMAND
diff --git a/packages/contentstack-auth/package.json b/packages/contentstack-auth/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@contentstack/cli-auth",
   "description": "Contentstack CLI plugin for authentication activities",
-  "version": "1.3.24",
+  "version": "1.3.25",
   "author": "Contentstack",
   "bugs": "https://github.com/contentstack/cli/issues",
   "scripts": {
diff --git a/packages/contentstack-bootstrap/README.md b/packages/contentstack-bootstrap/README.md
@@ -15,7 +15,7 @@ $ npm install -g @contentstack/cli-cm-bootstrap
 $ csdx COMMAND
 running command...
 $ csdx (--version)
-@contentstack/cli-cm-bootstrap/1.13.2 darwin-arm64 node-v22.14.0
+@contentstack/cli-cm-bootstrap/1.13.3 darwin-arm64 node-v22.14.0
 $ csdx --help [COMMAND]
 USAGE
   $ csdx COMMAND
diff --git a/packages/contentstack-bootstrap/package.json b/packages/contentstack-bootstrap/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@contentstack/cli-cm-bootstrap",
   "description": "Bootstrap contentstack apps",
-  "version": "1.13.2",
+  "version": "1.13.3",
   "author": "Contentstack",
   "bugs": "https://github.com/contentstack/cli/issues",
   "scripts": {
@@ -17,7 +17,7 @@
     "test:report": "nyc --reporter=lcov mocha \"test/**/*.test.js\""
   },
   "dependencies": {
-    "@contentstack/cli-cm-seed": "~1.10.2",
+    "@contentstack/cli-cm-seed": "~1.10.3",
     "@contentstack/cli-command": "~1.3.3",
     "@contentstack/cli-utilities": "~1.9.0",
     "inquirer": "8.2.6",
diff --git a/packages/contentstack-branches/README.md b/packages/contentstack-branches/README.md
@@ -37,7 +37,7 @@ $ npm install -g @contentstack/cli-cm-branches
 $ csdx COMMAND
 running command...
 $ csdx (--version)
-@contentstack/cli-cm-branches/1.3.0 darwin-arm64 node-v22.14.0
+@contentstack/cli-cm-branches/1.3.1 darwin-arm64 node-v22.14.0
 $ csdx --help [COMMAND]
 USAGE
   $ csdx COMMAND
diff --git a/packages/contentstack-branches/package.json b/packages/contentstack-branches/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@contentstack/cli-cm-branches",
   "description": "Contentstack CLI plugin to do branches operations",
-  "version": "1.3.0",
+  "version": "1.3.1",
   "author": "Contentstack",
   "bugs": "https://github.com/contentstack/cli/issues",
   "dependencies": {
diff --git a/packages/contentstack-bulk-publish/README.md b/packages/contentstack-bulk-publish/README.md
@@ -18,7 +18,7 @@ $ npm install -g @contentstack/cli-cm-bulk-publish
 $ csdx COMMAND
 running command...
 $ csdx (--version)
-@contentstack/cli-cm-bulk-publish/1.7.3 darwin-arm64 node-v22.14.0
+@contentstack/cli-cm-bulk-publish/1.7.4 darwin-arm64 node-v22.14.0
 $ csdx --help [COMMAND]
 USAGE
   $ csdx COMMAND
diff --git a/packages/contentstack-bulk-publish/package.json b/packages/contentstack-bulk-publish/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@contentstack/cli-cm-bulk-publish",
   "description": "Contentstack CLI plugin for bulk publish actions",
-  "version": "1.7.3",
+  "version": "1.7.4",
   "author": "Contentstack",
   "bugs": "https://github.com/contentstack/cli/issues",
   "dependencies": {
diff --git a/packages/contentstack-clone/README.md b/packages/contentstack-clone/README.md
@@ -16,7 +16,7 @@ $ npm install -g @contentstack/cli-cm-clone
 $ csdx COMMAND
 running command...
 $ csdx (--version)
-@contentstack/cli-cm-clone/1.13.2 darwin-arm64 node-v22.14.0
+@contentstack/cli-cm-clone/1.13.3 darwin-arm64 node-v22.14.0
 $ csdx --help [COMMAND]
 USAGE
   $ csdx COMMAND
diff --git a/packages/contentstack-clone/package.json b/packages/contentstack-clone/package.json
@@ -1,13 +1,13 @@
 {
   "name": "@contentstack/cli-cm-clone",
   "description": "Contentstack stack clone plugin",
-  "version": "1.13.2",
+  "version": "1.13.3",
   "author": "Contentstack",
   "bugs": "https://github.com/rohitmishra209/cli-cm-clone/issues",
   "dependencies": {
     "@colors/colors": "^1.6.0",
-    "@contentstack/cli-cm-export": "~1.15.0",
-    "@contentstack/cli-cm-import": "~1.20.0",
+    "@contentstack/cli-cm-export": "~1.15.2",
+    "@contentstack/cli-cm-import": "~1.20.2",
     "@contentstack/cli-command": "~1.3.3",
     "@contentstack/cli-utilities": "~1.9.0",
     "chalk": "^4.1.2",
diff --git a/packages/contentstack-config/README.md b/packages/contentstack-config/README.md
@@ -18,7 +18,7 @@ $ npm install -g @contentstack/cli-config
 $ csdx COMMAND
 running command...
 $ csdx (--version)
-@contentstack/cli-config/1.10.0 darwin-arm64 node-v22.14.0
+@contentstack/cli-config/1.10.1 darwin-arm64 node-v22.14.0
 $ csdx --help [COMMAND]
 USAGE
   $ csdx COMMAND
diff --git a/packages/contentstack-config/package.json b/packages/contentstack-config/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@contentstack/cli-config",
   "description": "Contentstack CLI plugin for configuration",
-  "version": "1.10.0",
+  "version": "1.10.1",
   "author": "Contentstack",
   "scripts": {
     "build": "npm run clean && npm run compile",
diff --git a/packages/contentstack-export-to-csv/package.json b/packages/contentstack-export-to-csv/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@contentstack/cli-cm-export-to-csv",
   "description": "Export entities to csv",
-  "version": "1.7.3",
+  "version": "1.7.4",
   "author": "Abhinav Gupta @abhinav-from-contentstack",
   "bugs": "https://github.com/contentstack/cli/issues",
   "dependencies": {
diff --git a/packages/contentstack-export/README.md b/packages/contentstack-export/README.md
@@ -48,7 +48,7 @@ $ npm install -g @contentstack/cli-cm-export
 $ csdx COMMAND
 running command...
 $ csdx (--version)
-@contentstack/cli-cm-export/1.15.1 darwin-arm64 node-v22.14.0
+@contentstack/cli-cm-export/1.15.2 darwin-arm64 node-v22.14.0
 $ csdx --help [COMMAND]
 USAGE
   $ csdx COMMAND
diff --git a/packages/contentstack-export/package.json b/packages/contentstack-export/package.json
@@ -1,12 +1,12 @@
 {
   "name": "@contentstack/cli-cm-export",
   "description": "Contentstack CLI plugin to export content from stack",
-  "version": "1.15.1",
+  "version": "1.15.2",
   "author": "Contentstack",
   "bugs": "https://github.com/contentstack/cli/issues",
   "dependencies": {
     "@contentstack/cli-command": "~1.3.3",
-    "@contentstack/cli-variants": "~1.1.5",
+    "@contentstack/cli-variants": "~1.1.6",
     "@contentstack/cli-utilities": "~1.9.0",
     "@oclif/core": "^3.27.0",
     "async": "^3.2.6",
@@ -21,8 +21,8 @@
     "winston": "^3.17.0"
   },
   "devDependencies": {
-    "@contentstack/cli-auth": "~1.3.24",
-    "@contentstack/cli-config": "~1.10.0",
+    "@contentstack/cli-auth": "~1.3.25",
+    "@contentstack/cli-config": "~1.10.1",
     "@contentstack/cli-dev-dependencies": "~1.2.4",
     "@oclif/plugin-help": "^5.2.20",
     "@oclif/test": "^4.1.6",
diff --git a/packages/contentstack-export/src/commands/cm/stacks/export.ts b/packages/contentstack-export/src/commands/cm/stacks/export.ts
@@ -9,6 +9,7 @@ import {
   ContentstackClient,
   FlagInput,
   pathValidator,
+  sanitizePath,
 } from '@contentstack/cli-utilities';
 import { ModuleExporter } from '../../../export';
 import { setupExportConfig, log, formatError, writeExportMetaFile } from '../../../utils';
@@ -108,7 +109,7 @@ export default class ExportCommand extends Command {
       exportConfig.region = this.region;
       exportConfig.developerHubBaseUrl = this.developerHubUrl;
       if (this.personalizeUrl) exportConfig.modules.personalize.baseURL[exportConfig.region.name] = this.personalizeUrl;
-      exportDir = exportConfig.cliLogsPath || exportConfig.data || exportConfig.exportDir;
+      exportDir = sanitizePath(exportConfig.cliLogsPath || exportConfig.data || exportConfig.exportDir);
       const managementAPIClient: ContentstackClient = await managementSDKClient(exportConfig);
       const moduleExporter = new ModuleExporter(managementAPIClient, exportConfig);
       await moduleExporter.start();
diff --git a/packages/contentstack-export/src/utils/export-config-handler.ts b/packages/contentstack-export/src/utils/export-config-handler.ts
@@ -1,6 +1,6 @@
 import merge from 'merge';
 import * as path from 'path';
-import { configHandler, isAuthenticated, FlagInput, cliux } from '@contentstack/cli-utilities';
+import { configHandler, isAuthenticated, FlagInput, cliux, sanitizePath } from '@contentstack/cli-utilities';
 import defaultConfig from '../config';
 import { readFile } from './file-helper';
 import { askExportDir, askAPIKey } from './interactive';
@@ -15,14 +15,14 @@ const setupConfig = async (exportCmdFlags: any): Promise<ExportConfig> => {
     const externalConfig = await readFile(exportCmdFlags['config']);
     config = merge.recursive(config, externalConfig);
   }
-  config.exportDir = exportCmdFlags['data'] || exportCmdFlags['data-dir'] || config.data || (await askExportDir());
+  config.exportDir = sanitizePath(exportCmdFlags['data'] || exportCmdFlags['data-dir'] || config.data || (await askExportDir()));
 
   const pattern = /[*$%#<>{}!&?]/g;
   if (pattern.test(config.exportDir)) {
     cliux.print(`\nPlease add a directory path without any of the special characters: (*,&,{,},[,],$,%,<,>,?,!)`, {
       color: 'yellow',
     });
-    config.exportDir = await askExportDir();
+    config.exportDir = sanitizePath(await askExportDir());
   }
   config.exportDir = config.exportDir.replace(/['"]/g, '');
   config.exportDir = path.resolve(config.exportDir);
diff --git a/packages/contentstack-export/src/utils/logger.ts b/packages/contentstack-export/src/utils/logger.ts
@@ -137,7 +137,7 @@ function init(_logPath: string) {
 }
 
 export const log = async (config: ExportConfig, message: any, type: string) => {
-  const logsPath = config.cliLogsPath || config.data;
+  const logsPath = sanitizePath(config.cliLogsPath || config.data);
   // ignoring the type argument, as we are not using it to create a logfile anymore
   if (type !== 'error') {
     // removed type argument from init method
diff --git a/packages/contentstack-import-setup/README.md b/packages/contentstack-import-setup/README.md
@@ -47,7 +47,7 @@ $ npm install -g @contentstack/cli-cm-import-setup
 $ csdx COMMAND
 running command...
 $ csdx (--version)
-@contentstack/cli-cm-import-setup/1.1.1 darwin-arm64 node-v22.14.0
+@contentstack/cli-cm-import-setup/1.1.2 darwin-arm64 node-v22.14.0
 $ csdx --help [COMMAND]
 USAGE
   $ csdx COMMAND
diff --git a/packages/contentstack-import-setup/package.json b/packages/contentstack-import-setup/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@contentstack/cli-cm-import-setup",
   "description": "Contentstack CLI plugin to setup the mappers and configurations for the import command",
-  "version": "1.1.1",
+  "version": "1.1.2",
   "author": "Contentstack",
   "bugs": "https://github.com/contentstack/cli/issues",
   "dependencies": {
diff --git a/packages/contentstack-import-setup/src/utils/import-config-handler.ts b/packages/contentstack-import-setup/src/utils/import-config-handler.ts
@@ -20,13 +20,13 @@ const setupConfig = async (importCmdFlags: any): Promise<ImportConfig> => {
   //   config = merge.recursive(config, externalConfig);
   // }
 
-  config.contentDir = importCmdFlags['data'] || importCmdFlags['data-dir'] || config.data || (await askContentDir());
+  config.contentDir = sanitizePath(importCmdFlags['data'] || importCmdFlags['data-dir'] || config.data || (await askContentDir()));
   const pattern = /[*$%#<>{}!&?]/g;
   if (pattern.test(config.contentDir)) {
     cliux.print(`\nPlease add a directory path without any of the special characters: (*,&,{,},[,],$,%,<,>,?,!)`, {
       color: 'yellow',
     });
-    config.contentDir = await askContentDir();
+    config.contentDir = sanitizePath(await askContentDir());
   }
   config.contentDir = config.contentDir.replace(/['"]/g, '');
   config.contentDir = path.resolve(config.contentDir);
diff --git a/packages/contentstack-import-setup/src/utils/logger.ts b/packages/contentstack-import-setup/src/utils/logger.ts
@@ -140,7 +140,7 @@ function init(_logPath: string) {
 }
 
 export const log = async (config: ImportConfig, message: any, type: string) => {
-  config.cliLogsPath = config.cliLogsPath || config.data || path.join(__dirname, 'logs');
+  config.cliLogsPath = sanitizePath(config.cliLogsPath || config.data || path.join(__dirname, 'logs'));
   // ignoring the type argument, as we are not using it to create a logfile anymore
   if (type !== 'error') {
     // removed type argument from init method
diff --git a/packages/contentstack-import/README.md b/packages/contentstack-import/README.md
@@ -47,7 +47,7 @@ $ npm install -g @contentstack/cli-cm-import
 $ csdx COMMAND
 running command...
 $ csdx (--version)
-@contentstack/cli-cm-import/1.20.1 darwin-arm64 node-v22.14.0
+@contentstack/cli-cm-import/1.20.2 darwin-arm64 node-v22.14.0
 $ csdx --help [COMMAND]
 USAGE
   $ csdx COMMAND
diff --git a/packages/contentstack-import/package.json b/packages/contentstack-import/package.json
@@ -1,15 +1,15 @@
 {
   "name": "@contentstack/cli-cm-import",
   "description": "Contentstack CLI plugin to import content into stack",
-  "version": "1.20.1",
+  "version": "1.20.2",
   "author": "Contentstack",
   "bugs": "https://github.com/contentstack/cli/issues",
   "dependencies": {
-    "@contentstack/cli-audit": "~1.9.0",
+    "@contentstack/cli-audit": "~1.9.1",
     "@contentstack/cli-command": "~1.3.3",
     "@contentstack/cli-utilities": "~1.9.0",
     "@contentstack/management": "~1.18.4",
-    "@contentstack/cli-variants": "~1.1.5",
+    "@contentstack/cli-variants": "~1.1.6",
     "@oclif/core": "^3.27.0",
     "big-json": "^3.2.0",
     "bluebird": "^3.7.2",
diff --git a/packages/contentstack-import/src/utils/import-config-handler.ts b/packages/contentstack-import/src/utils/import-config-handler.ts
@@ -20,13 +20,13 @@ const setupConfig = async (importCmdFlags: any): Promise<ImportConfig> => {
     config = merge.recursive(config, externalConfig);
   }
 
-  config.contentDir = importCmdFlags['data'] || importCmdFlags['data-dir'] || config.data || (await askContentDir());
+  config.contentDir = sanitizePath(importCmdFlags['data'] || importCmdFlags['data-dir'] || config.data || (await askContentDir()));
   const pattern = /[*$%#<>{}!&?]/g;
   if (pattern.test(config.contentDir)) {
     cliux.print(`\nPlease add a directory path without any of the special characters: (*,&,{,},[,],$,%,<,>,?,!)`, {
       color: 'yellow',
     });
-    config.contentDir = await askContentDir();
+    config.contentDir = sanitizePath(await askContentDir());
   }
   config.contentDir = config.contentDir.replace(/['"]/g, '');
   config.contentDir = path.resolve(config.contentDir);
diff --git a/packages/contentstack-import/src/utils/logger.ts b/packages/contentstack-import/src/utils/logger.ts
@@ -140,7 +140,7 @@ function init(_logPath: string) {
 }
 
 export const log = async (config: ImportConfig, message: any, type: string) => {
-  config.cliLogsPath = config.cliLogsPath || config.data || path.join(__dirname, 'logs');
+  config.cliLogsPath = sanitizePath(config.cliLogsPath || config.data || path.join(__dirname, 'logs'));
   // ignoring the type argument, as we are not using it to create a logfile anymore
   if (type !== 'error') {
     // removed type argument from init method
diff --git a/packages/contentstack-migrate-rte/README.md b/packages/contentstack-migrate-rte/README.md
@@ -16,7 +16,7 @@ $ npm install -g @contentstack/cli-cm-migrate-rte
 $ csdx COMMAND
 running command...
 $ csdx (--version)
-@contentstack/cli-cm-migrate-rte/1.4.21 darwin-arm64 node-v22.14.0
+@contentstack/cli-cm-migrate-rte/1.4.22 darwin-arm64 node-v22.14.0
 $ csdx --help [COMMAND]
 USAGE
   $ csdx COMMAND
diff --git a/packages/contentstack-migrate-rte/package.json b/packages/contentstack-migrate-rte/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@contentstack/cli-cm-migrate-rte",
   "description": "Contentstack CLI plugin to migrate HTML RTE to JSON RTE",
-  "version": "1.4.21",
+  "version": "1.4.22",
   "author": "contentstack",
   "bugs": "https://github.com/contentstack/cli/issues",
   "dependencies": {
diff --git a/packages/contentstack-migration/README.md b/packages/contentstack-migration/README.md
@@ -21,7 +21,7 @@ $ npm install -g @contentstack/cli-migration
 $ csdx COMMAND
 running command...
 $ csdx (--version)
-@contentstack/cli-migration/1.6.5 darwin-arm64 node-v22.14.0
+@contentstack/cli-migration/1.6.6 darwin-arm64 node-v22.14.0
 $ csdx --help [COMMAND]
 USAGE
   $ csdx COMMAND
diff --git a/packages/contentstack-migration/package.json b/packages/contentstack-migration/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@contentstack/cli-migration",
-  "version": "1.6.5",
+  "version": "1.6.6",
   "author": "@contentstack",
   "bugs": "https://github.com/contentstack/cli/issues",
   "dependencies": {
diff --git a/packages/contentstack-seed/package.json b/packages/contentstack-seed/package.json
@@ -1,11 +1,11 @@
 {
   "name": "@contentstack/cli-cm-seed",
   "description": "create a Stack from existing content types, entries, assets, etc.",
-  "version": "1.10.2",
+  "version": "1.10.3",
   "author": "Contentstack",
   "bugs": "https://github.com/contentstack/cli/issues",
   "dependencies": {
-    "@contentstack/cli-cm-import": "~1.20.0",
+    "@contentstack/cli-cm-import": "~1.20.2",
     "@contentstack/cli-command": "~1.3.3",
     "@contentstack/cli-utilities": "~1.9.0",
     "@contentstack/management": "~1.18.4",
diff --git a/packages/contentstack-utilities/src/helpers.ts b/packages/contentstack-utilities/src/helpers.ts
@@ -54,7 +54,16 @@ export const validatePath = (input: string) => {
 export const escapeRegExp = (str: string) => str?.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 
 // To remove the relative path
-export const sanitizePath = (str: string) => str?.replace(/^(\.\.(\/|\\|$))+/, '');
+export const sanitizePath = (str: string) => {
+  if (typeof str !== 'string') 
+    return;
+  
+  const decodedStr = decodeURIComponent(str);
+  return decodedStr
+    ?.replace(/^([\/\\]){2,}/, "./") // Normalize leading slashes/backslashes to ''
+    .replace(/[\/\\]+/g, "/") // Replace multiple slashes/backslashes with a single '/'
+    .replace(/(\.\.(\/|\\|$))+/g, ""); // Remove directory traversal (../ or ..\)
+};
 
 // To validate the UIDs of assets
 export const validateUids = (uid) => /^[a-zA-Z0-9]+$/.test(uid);
diff --git a/packages/contentstack-variants/package.json b/packages/contentstack-variants/package.json
diff --git a/packages/contentstack/README.md b/packages/contentstack/README.md
diff --git a/packages/contentstack/package.json b/packages/contentstack/package.json
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml

Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`{`
`2`	`2`	`"name": "@contentstack/cli-audit",`
`3`		`- "version": "1.9.0",`
	`3`	`+ "version": "1.9.1",`
`4`	`4`	`"description": "Contentstack audit plugin",`
`5`	`5`	`"author": "Contentstack CLI",`
`6`	`6`	`"homepage": "https://github.com/contentstack/cli",`
Original file line number	Diff line number	Diff line change
`@@ -1,7 +1,7 @@`
`1`	`1`	`{`
`2`	`2`	`"name": "@contentstack/cli-auth",`
`3`	`3`	`"description": "Contentstack CLI plugin for authentication activities",`
`4`		`- "version": "1.3.24",`
	`4`	`+ "version": "1.3.25",`
`5`	`5`	`"author": "Contentstack",`
`6`	`6`	`"bugs": "https://github.com/contentstack/cli/issues",`
`7`	`7`	`"scripts": {`
Original file line number	Diff line number	Diff line change
`@@ -1,7 +1,7 @@`
`1`	`1`	`{`
`2`	`2`	`"name": "@contentstack/cli-cm-branches",`
`3`	`3`	`"description": "Contentstack CLI plugin to do branches operations",`
`4`		`- "version": "1.3.0",`
	`4`	`+ "version": "1.3.1",`
`5`	`5`	`"author": "Contentstack",`
`6`	`6`	`"bugs": "https://github.com/contentstack/cli/issues",`
`7`	`7`	`"dependencies": {`