fix(stac_cli): remove snake case conversion#467
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
💤 Files with no reviewable changes (1)
📝 WalkthroughWalkthroughThe build service was changed to use the artifact name verbatim when naming generated JSON files; the string utility method that converted names to snake_case ( Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
📝 Coding Plan
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment Tip CodeRabbit can use Trivy to scan for security misconfigurations and secrets in Infrastructure as Code files.Add a .trivyignore file to your project to customize which findings Trivy reports. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
packages/stac_cli/lib/src/services/build_service.dart (1)
497-501:⚠️ Potential issue | 🔴 CriticalValidate artifact names before joining paths to prevent path escape and invalid filenames
Line 497 now trusts user-provided names directly. Combined with Line 498, values like
/home,../x, ora/bcan escape/reshape the target path; reserved characters can also break builds on Windows.🔧 Suggested hardening patch
- final fileName = artifact.artifactName; - final outputFilePath = path.join(outputDir, '$fileName.json'); + final fileName = artifact.artifactName.trim(); + if (fileName.isEmpty || + fileName == '.' || + fileName == '..' || + fileName.contains(RegExp(r'[\\/]')) || + fileName.contains(RegExp(r'[<>:"|?*]'))) { + throw BuildException( + 'Invalid ${artifact.logLabel} name "$fileName". ' + 'Names must not contain path separators or reserved filename characters.', + ); + } + + final normalizedOutputDir = path.normalize(outputDir); + final outputFilePath = path.normalize( + path.join(normalizedOutputDir, '$fileName.json'), + ); + if (!path.isWithin(normalizedOutputDir, outputFilePath)) { + throw BuildException( + 'Invalid ${artifact.logLabel} name "$fileName": output path escapes build directory.', + ); + }🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@packages/stac_cli/lib/src/services/build_service.dart` around lines 497 - 501, artifact.artifactName is used directly to build outputFilePath and can contain path separators or reserved chars allowing path traversal or invalid filenames; validate and sanitize artifact.artifactName before joining paths in the code that creates outputFilePath and calls FileUtils.writeFile. Ensure you canonicalize to a safe basename (strip directory components), reject or normalize ".." and absolute paths, remove or replace path separators and Windows-reserved characters, and enforce a whitelist regex (e.g., alphanumerics, dash, underscore) or throw a clear error if the name is invalid; update the code that sets outputFilePath and the generatedResults key to use the sanitized name to prevent escaping the intended outputDir or creating invalid filenames.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Outside diff comments:
In `@packages/stac_cli/lib/src/services/build_service.dart`:
- Around line 497-501: artifact.artifactName is used directly to build
outputFilePath and can contain path separators or reserved chars allowing path
traversal or invalid filenames; validate and sanitize artifact.artifactName
before joining paths in the code that creates outputFilePath and calls
FileUtils.writeFile. Ensure you canonicalize to a safe basename (strip directory
components), reject or normalize ".." and absolute paths, remove or replace path
separators and Windows-reserved characters, and enforce a whitelist regex (e.g.,
alphanumerics, dash, underscore) or throw a clear error if the name is invalid;
update the code that sets outputFilePath and the generatedResults key to use the
sanitized name to prevent escaping the intended outputDir or creating invalid
filenames.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: b8c65c35-99d0-4f05-8378-4aeb79fac6be
📒 Files selected for processing (1)
packages/stac_cli/lib/src/services/build_service.dart
|
@coderabbitai are we using |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: Length of output: 1518
This means |
2 participants
Description
Removed the automatic conversion of artifact names to snake_case when generating JSON files with
stac build.BuildService._processArtifactsnow uses the user-providedartifact.artifactNamedirectly as the base for the output JSON filename, ensuring the generatedscreensandthemesJSON files exactly match the names specified in@StacScreen/@StacThemeRefannotations.Type of Change
Summary by CodeRabbit