fix: Enforce stricter validation rules for the plugin name. [INS-5310 & INS-5408 & INS-5333] by pavkout · Pull Request #8639 · Kong/insomnia

pavkout · 2025-04-23T14:49:00Z

Enforce stricter validation rules for the plugin name.

Empty state - without plugins

With Installed plugin list

Initial View

Error exists

+    );
+  } catch (err) {
+    // Log and rethrow any installation errors
+    console.error(`[plugins] Failed to install plugin ${pluginName}:`, err);


+      try {
+        await rm(tmpDir, { recursive: true, force: true });
+      } catch (error) {
+        console.warn(`[plugins] Failed to clean tmp dir ${tmpDir}:`, error);


+  const pluginDir = getSafePluginDir(pluginName);
+
+  try {
+    const packagePath = path.resolve(pluginDir, 'package.json');


+
+  try {
+    const packagePath = path.resolve(pluginDir, 'package.json');
+    const mainJsPath = path.resolve(pluginDir, 'main.js');


      try {
-        const modulePath = path.join(p, filename);
-        const packageJSONPath = path.join(modulePath, 'package.json');
+        const modulePath = path.resolve(p, filename);


      try {
-        const modulePath = path.join(p, filename);
-        const packageJSONPath = path.join(modulePath, 'package.json');
+        const modulePath = path.resolve(p, filename);


-        const modulePath = path.join(p, filename);
-        const packageJSONPath = path.join(modulePath, 'package.json');
+        const modulePath = path.resolve(p, filename);
+        const packageJSONPath = path.resolve(modulePath, 'package.json');


-          if (p.indexOf(modulePath) === 0) {
-            delete global.require.cache[p];
+        // Sanitize paths and check for known module patterns to prevent command injection
+        const safeModulePath = path.resolve(modulePath);


godfrzero · 2025-04-30T15:39:13Z

Let's maintain the warning-type styling for enabling elevated plugin access. This has a significant impact on plugin access and the visual styling should emphasize that it's not a checkbox to be ticked lightly.

pavkout · 2025-05-06T12:50:56Z

Let's maintain the warning-type styling for enabling elevated plugin access. This has a significant impact on plugin access and the visual styling should emphasize that it's not a checkbox to be ticked lightly.

@godfrzero I have changed it like this

…gin name input

…e path resolution for security

…luginDir and improving path handling

….js test suite

…additional utility functions

…gin installation logic

…ctions

…n plugin settings

…ctions

…n interactions tests

…roved plugin validation

…r and rename webUtils import

…parameter

…moving unnecessary properties

…4 characters

…lugin reload logic

INS-5408 & INS-5333] (#8639) * feat: Add CreatePluginModal component for plugin creation * feat: Integrate CreatePluginModal for streamlined plugin creation * feat: Enhance plugin creation with path validation and error handling * feat: Add comprehensive validation tests for plugin name generation * feat: Improve path validation for plugin directory to prevent traversal attacks * feat: Add checks to prevent overwriting existing plugin files during creation * feat: Add plugin name validation and sanitization to prevent path traversal * fix: Correct import order in create-plugin-modal component * fix: Correct import order in plugins interactions test * feat: Enhance plugin name validation to prevent invalid formats and add test ID for button * test: Refactor plugin interactions tests for improved readability and maintainability * fix: Improve code readability by adding comments and removing unnecessary whitespace in create plugin directory function * fix: Correct import order in plugins interactions test * Imports * refactor: Improve import order and enhance code readability in CreatePluginModal component * test: Update plugin interactions tests to use soft assertions for improved error handling * fix: Remove version parameter from createPlugin function call in Root component * refactor: Enhance plugin name validation and remove version parameter from createPlugin function * refactor: Remove plugin name validation logic from CreatePluginModal component * refactor: Simplify destructuring and improve button class order in Plugins component * test: Update plugin name validation messages and add additional rejection cases * refactor: Enhance plugin name validation to prevent OS command injection and disallow path traversal * refactor: Simplify error handling in CreatePluginModal component * test: Add validation for plugin name restrictions including path traversal and length * refactor: Rename moduleName to pluginName in createPlugin function for clarity * refactor: Add path traversal validation in getSafePluginDir function * test: Add comprehensive validation for plugin name restrictions in smoke tests * feat: Implement comprehensive validation for plugin names and directory safety * fix: Adjust modal content height to auto for better responsiveness * Modify the plugins tab * feat: Enhance CreatePluginModal with accessibility attributes for plugin name input * refactor: Rename _traversePluginPath to traversePluginPath and enhance path resolution for security * refactor: Simplify plugin directory validation by extracting getSafePluginDir and improving path handling * Modify the install plugin functionality * Improvements * feat: Export containsOnlyDeprecationWarnings function for broader usage * refactor: Remove isDeprecatedDependencies tests to streamline install.js test suite * feat: Export utility functions for broader access in the plugin system * fix: Validate plugin metadata by checking for missing tarball URL * Improve plugin system by enhancing metadata validation and exporting additional utility functions * fix: Set modal content height to 100% for consistent display * refactor: Rename isInsomniaPlugin to getPluginInfo and streamline plugin installation logic * test: Add comprehensive tests for plugin installation and utility functions * delete: Remove obsolete test file for plugin installation * refactor: Update elevated access warning display and improve layout in plugin settings * feat: Add support for scoped package names in plugin installation functions * refactor: Improve layout and error handling in plugin settings component * feat: Add validation for plugin name input during installation * feat: Enhance plugin name validation to support scoped package names * test: Update error messages for invalid scoped package names in plugin interactions tests * feat: Pass allowScopedPackageNames parameter to getPluginInfo for improved plugin validation * feat: Add support for scoped package names in plugin validation regex * feat: Update installPlugin to accept allowScopedPackageNames parameter and rename webUtils import * feat: Update installPlugin handler to accept allowScopedPackageNames parameter * refactor: Simplify mock implementations in install-plugin tests by removing unnecessary properties * fix: Correct plugin name length validation to enforce a maximum of 214 characters * refactor: Simplify state management in Plugins component and update plugin reload logic

pavkout force-pushed the feature/ins-5310 branch from 1833d41 to c224a46 Compare April 23, 2025 14:52

github-advanced-security AI found potential problems Apr 23, 2025

View reviewed changes

Comment thread packages/insomnia/src/plugins/create.ts Fixed

Comment thread packages/insomnia/src/plugins/create.ts Fixed

github-advanced-security AI found potential problems Apr 23, 2025

View reviewed changes

Comment thread packages/insomnia/src/plugins/create.ts Fixed

github-advanced-security AI found potential problems Apr 23, 2025

View reviewed changes

Comment thread packages/insomnia/src/plugins/create.ts Fixed

Comment thread packages/insomnia/src/plugins/create.ts Fixed

pavkout self-assigned this Apr 23, 2025

pavkout requested a review from a team April 23, 2025 15:32

jackkav reviewed Apr 23, 2025

View reviewed changes

Comment thread packages/insomnia-smoke-test/tests/smoke/plugins-interactions.test.ts Outdated

jackkav reviewed Apr 23, 2025

View reviewed changes

Comment thread packages/insomnia/src/plugins/create.ts Outdated

jackkav reviewed Apr 23, 2025

View reviewed changes

Comment thread packages/insomnia/src/ui/components/settings/plugins.tsx Outdated

github-advanced-security AI found potential problems Apr 28, 2025

View reviewed changes

pavkout force-pushed the feature/ins-5310 branch 2 times, most recently from dd41f52 to 95a150b Compare April 30, 2025 13:53

jackkav reviewed May 6, 2025

View reviewed changes

Comment thread packages/insomnia-smoke-test/tests/smoke/plugins-interactions.test.ts

jackkav reviewed May 6, 2025

View reviewed changes

Comment thread packages/insomnia/src/__tests__/install-plugin.test.ts

jackkav previously approved these changes May 6, 2025

View reviewed changes

pavkout force-pushed the feature/ins-5310 branch from 03effe1 to 8ceb72e Compare May 6, 2025 12:52

pavkout dismissed jackkav’s stale review via 3ed13fe May 6, 2025 12:53

pavkout requested a review from jackkav May 6, 2025 13:21

pavkout force-pushed the feature/ins-5310 branch 2 times, most recently from 786af2c to dddded8 Compare May 9, 2025 11:24

godfrzero reviewed May 15, 2025

View reviewed changes

Comment thread packages/insomnia/src/utils/plugin.ts Outdated

pavkout force-pushed the feature/ins-5310 branch 2 times, most recently from 3babbe8 to 3aa067a Compare May 16, 2025 20:53

pavkout requested review from gatzjames and godfrzero May 16, 2025 21:45

pavkout changed the title ~~fix: Enforce stricter validation rules for the plugin name. [INS-5310]~~ fix: Enforce stricter validation rules for the plugin name. [INS-5310 & INS-5408 & INS-5333] May 19, 2025

gatzjames force-pushed the feature/ins-5310 branch from 3aa067a to 8a4c8c3 Compare May 19, 2025 12:41

gatzjames approved these changes May 19, 2025

View reviewed changes

pavkout added 27 commits May 20, 2025 19:20

feat: Enhance CreatePluginModal with accessibility attributes for plu…

f282d21

…gin name input

refactor: Rename _traversePluginPath to traversePluginPath and enhanc…

689cbcc

…e path resolution for security

refactor: Simplify plugin directory validation by extracting getSafeP…

22d8029

…luginDir and improving path handling

Modify the install plugin functionality

22dd72b

Improvements

e678597

feat: Export containsOnlyDeprecationWarnings function for broader usage

773c50d

refactor: Remove isDeprecatedDependencies tests to streamline install…

accf395

….js test suite

feat: Export utility functions for broader access in the plugin system

4f0369a

fix: Validate plugin metadata by checking for missing tarball URL

e8969a2

Improve plugin system by enhancing metadata validation and exporting …

2c3cc86

…additional utility functions

fix: Set modal content height to 100% for consistent display

645b4d4

refactor: Rename isInsomniaPlugin to getPluginInfo and streamline plu…

9e7e4e5

…gin installation logic

test: Add comprehensive tests for plugin installation and utility fun…

2dafafa

…ctions

delete: Remove obsolete test file for plugin installation

4c6737e

refactor: Update elevated access warning display and improve layout i…

0bc059e

…n plugin settings

feat: Add support for scoped package names in plugin installation fun…

847a5fe

…ctions

refactor: Improve layout and error handling in plugin settings component

d675afc

feat: Add validation for plugin name input during installation

b0ba20b

feat: Enhance plugin name validation to support scoped package names

d7e07cc

test: Update error messages for invalid scoped package names in plugi…

bbcddfd

…n interactions tests

feat: Pass allowScopedPackageNames parameter to getPluginInfo for imp…

78de318

…roved plugin validation

feat: Add support for scoped package names in plugin validation regex

2242766

feat: Update installPlugin to accept allowScopedPackageNames paramete…

f277176

…r and rename webUtils import

feat: Update installPlugin handler to accept allowScopedPackageNames …

3ce03f5

…parameter

refactor: Simplify mock implementations in install-plugin tests by re…

5d28593

…moving unnecessary properties

fix: Correct plugin name length validation to enforce a maximum of 21…

185440e

…4 characters

refactor: Simplify state management in Plugins component and update p…

81a0ff1

…lugin reload logic

pavkout force-pushed the feature/ins-5310 branch from af4b749 to 81a0ff1 Compare May 20, 2025 17:20

pavkout merged commit 010c7e7 into Kong:develop May 21, 2025

Navigation Menu

Uh oh!

fix: Enforce stricter validation rules for the plugin name. [INS-5310 & INS-5408 & INS-5333] - #8639

fix: Enforce stricter validation rules for the plugin name. [INS-5310 & INS-5408 & INS-5333]#8639
pavkout merged 57 commits into
Kong:developfrom
pavkout:feature/ins-5310

pavkout commented Apr 23, 2025 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Check notice

Check notice

Check warning

Check warning

Check warning

Check warning

Check warning

Check warning

godfrzero commented Apr 30, 2025

Uh oh!

Uh oh!

Uh oh!

pavkout commented May 6, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Uh oh!

Conversation

pavkout commented Apr 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Empty state - without plugins

With Installed plugin list

Initial View

Error exists

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Check notice

Check notice

Check warning

Check warning

Check warning

Check warning

Check warning

Check warning

godfrzero commented Apr 30, 2025

Uh oh!

Uh oh!

Uh oh!

pavkout commented May 6, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

pavkout commented Apr 23, 2025 •

edited

Loading