CLI: Be strict about file I/O
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 21
- Forks
- 23
- Avg merge
- 1d 22h
- Merged PRs (30d)
- 17
Description
There are various places in the CLI where files can be read from and written to the user's file system. For example, reading files for a deploy, or writing output from an execute run, or cleaning the workflows folder when checking out.
Some of this IO is unbound: the CLI can read and write from any location on the user's system. This is a bit icky: to be a good digital citizen the CLI should really only read/write within a project root (or if there is no root, from the working folder).
We need to go through all these IO locations and put some kind of basic bounds on the valid paths.
TODO: I'll populate the list of all the places where the CLI can read/write files
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by inventorying the CLI file I/O used for deploy reads, execute-run output, and cleanup of the workflows folder. Trace each location from its CLI entry point and document the project-root or working-folder boundary; done means all relevant read and write paths have explicit bounds.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- cli, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100