This commit is contained in:
Henry Heng 2025-11-15 18:11:15 +00:00 committed by GitHub
parent 8eea585e11
commit 74b1892cd1
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 2 additions and 2 deletions

View File

@ -1517,11 +1517,11 @@ export const executeJavaScriptCode = async (
// Install libraries // Install libraries
for (const library of librariesToInstall) { for (const library of librariesToInstall) {
// Validate library name to prevent command injection. // Validate library name to prevent command injection.
const validPackageNameRegex = /^(@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/; const validPackageNameRegex = /^(@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/
if (validPackageNameRegex.test(library)) { if (validPackageNameRegex.test(library)) {
await sbx.commands.run(`npm install ${library}`) await sbx.commands.run(`npm install ${library}`)
} else { } else {
console.warn(`[Sandbox] Skipping installation of invalid module: ${library}`); console.warn(`[Sandbox] Skipping installation of invalid module: ${library}`)
} }
} }