feat: add filename validation for windows

[dominikg]

The vue-inspector by @webfansplz contains code that prevents some filenames from being opened with a shell command

https://github.com/webfansplz/vite-plugin-vue-inspector/blob/main/src/launch-editor.ts#L336-L357

This is to prevent possible attacks where a crafted filename could be used to execute malicious commands.

Currently launch-editor does not have a check like this. It's hard to exploit because there is an fs.existsSync check but for defense in depth it would be better to not let these kinds of filenames through

The regex here https://github.com/webfansplz/vite-plugin-vue-inspector/blob/main/src/launch-editor.ts#L108-L112 looks longish, maybe a smaller list of forbidden chars does the trick too

[haoqunjiang]

These are basically backports of facebook/create-react-app#4866 and facebook/create-react-app#5431
As Unicode character class escape has been supported since Node.js 10¹, I think we can use the uncompiled version here.

The only remaining problem is that this RegExp can't be parsed with our current ESLint setup.
I'll try to fix this issue when I have the time to move away from eslint-plugin-vue-libs and bump the ESLint major version in this repository.

Footnotes

1. https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Regular_expressions/Unicode_character_class_escape ↩

[dominikg]

@sodatea your fix for this broke svelte-inspector for sveltekit +page files: sveltejs/vite-plugin-svelte#943 (comment)

is + an exploitable char in windows filenames?

[haoqunjiang]

After reading https://stackoverflow.com/q/4094699/2302258, I believe it's not exploitable.
Let me think this validation logic over. It might be better to escape than validate.

[dominikg]

expanding the safe chars list or switching to only blocking bad chars both seem fine to me too, but if there is a way to properly escape the path before sending it to cmd thats even better

[oneezy]

this should be re-opened. we're still getting issues on Win11

Reference

issue: sveltejs/vite-plugin-svelte#943 (comment)