Escape characters in project name (#839)

* Escape more chars * Update test * remove console.log * remove extra file * update gitignore
stripe · Dec 4, 2024 · cb9bba6 · cb9bba6
1 parent 85f290b
commit cb9bba6
Show file tree

Hide file tree

Showing 4 changed files with 29 additions and 19 deletions.
diff --git a/.gitignore b/.gitignore
@@ -5,3 +5,4 @@ node_modules
 .DS_Store
 test/workspace/.vscode
 dist
+jdt-language-server-latest.tar.gz
diff --git a/package.json b/package.json
@@ -64,7 +64,8 @@
         },
         "stripe.projectName": {
           "type": "string",
-          "description": "the project name to read from for config (default \"default\")"
+          "description": "the project name to read from for config (default \"default\")",
+          "pattern": "^[a-zA-Z0-9_-\\s]+$"
         },
         "stripe.telemetry.enabled": {
           "type": "boolean",

diff --git a/src/stripeTerminal.ts b/src/stripeTerminal.ts
@@ -38,23 +38,29 @@ export class StripeTerminal {
       'stripe',
       new vscode.ShellExecution(cliPath, [
         command,
-        ...args.map((arg) => ({
-          quoting: vscode.ShellQuoting.Strong,
-          value: arg,
-        })),
-        ...globalCLIFlags.map((arg) => ({
-          quoting: vscode.ShellQuoting.Strong,
-          value: arg,
-        })),
-      ])
+        ...args,
+        ...globalCLIFlags
+      ],
+      {
+        shellQuoting: {
+          escape: {
+            escapeChar: '\\',
+            charsToEscape: '&`|"\'',
+          }
+        }
+      }
+    )
     ));
   }
 
   // The Stripe CLI supports a number of flags for every command. See https://stripe.com/docs/cli/flags
   private getGlobalCLIFlags(): Array<string> {
     const stripeConfig = vscode.workspace.getConfiguration('stripe');
 
-    const projectName = stripeConfig.get('projectName', null);
+    let projectName = stripeConfig.get<string | null>('projectName', null);
+    if (projectName !== null) {
+      projectName = projectName.replace(/[\\"'`]/g, '');
+    }
 
     const projectNameFlag = projectName ? ['--project-name', projectName] : [];
 

diff --git a/test/suite/stripeTerminal.test.ts b/test/suite/stripeTerminal.test.ts
@@ -52,15 +52,17 @@ suite('stripeTerminal', function () {
             'stripe',
             new vscode.ShellExecution(path, [
               'listen',
-              {
-                quoting: vscode.ShellQuoting.Strong,
-                value: '--forward-to'
+              '--forward-to',
+              'localhost',
+            ],
+            {
+              shellQuoting: {
+                escape: {
+                  escapeChar: '\\',
+                  charsToEscape: '&`|"\'',
+                },
               },
-              {
-                quoting: vscode.ShellQuoting.Strong,
-                value: 'localhost'
-              }
-            ])
+            }),
           ),
         ]);
       });