mirror of
https://github.com/garrytan/gstack.git
synced 2026-05-02 11:45:20 +02:00
Garry Tan
ffb56b556d
gstack-settings-hook interpolated $SETTINGS_FILE directly into bun -e double-quoted blocks. A path containing quotes or backticks breaks the JS string context, enabling arbitrary code execution. Replace direct interpolation with environment variables (process.env). Same fix applied to gstack-team-init which had the same pattern. Systematic audit confirmed only these two scripts were vulnerable — all other bin/ scripts already use stdin piping or env vars. Closes #858 Co-Authored-By: Gus <garagon@users.noreply.github.com>
83 lines
2.8 KiB
Bash
Executable File
83 lines
2.8 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# gstack-settings-hook — add/remove SessionStart hooks in Claude Code settings.json
|
|
#
|
|
# Usage:
|
|
# gstack-settings-hook add <hook-command> # add SessionStart hook
|
|
# gstack-settings-hook remove <hook-command> # remove SessionStart hook
|
|
#
|
|
# Requires: bun (already a gstack hard dependency)
|
|
# Writes atomically: .tmp + rename to prevent corruption on crash/disk-full.
|
|
|
|
set -euo pipefail
|
|
|
|
ACTION="${1:-}"
|
|
HOOK_CMD="${2:-}"
|
|
SETTINGS_FILE="${GSTACK_SETTINGS_FILE:-$HOME/.claude/settings.json}"
|
|
|
|
if [ -z "$ACTION" ] || [ -z "$HOOK_CMD" ]; then
|
|
echo "Usage: gstack-settings-hook {add|remove} <hook-command>" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if ! command -v bun >/dev/null 2>&1; then
|
|
echo "Error: bun is required but not installed." >&2
|
|
exit 1
|
|
fi
|
|
|
|
case "$ACTION" in
|
|
add)
|
|
GSTACK_SETTINGS_PATH="$SETTINGS_FILE" GSTACK_HOOK_CMD="$HOOK_CMD" bun -e "
|
|
const fs = require('fs');
|
|
const settingsPath = process.env.GSTACK_SETTINGS_PATH;
|
|
const hookCmd = process.env.GSTACK_HOOK_CMD;
|
|
|
|
let settings = {};
|
|
try { settings = JSON.parse(fs.readFileSync(settingsPath, 'utf8')); } catch {}
|
|
|
|
if (!settings.hooks) settings.hooks = {};
|
|
if (!settings.hooks.SessionStart) settings.hooks.SessionStart = [];
|
|
|
|
// Dedup: check if hook command already registered
|
|
const exists = settings.hooks.SessionStart.some(entry =>
|
|
entry.hooks && entry.hooks.some(h => h.command && h.command.includes('gstack-session-update'))
|
|
);
|
|
|
|
if (!exists) {
|
|
settings.hooks.SessionStart.push({
|
|
hooks: [{ type: 'command', command: hookCmd }]
|
|
});
|
|
}
|
|
|
|
const tmp = settingsPath + '.tmp';
|
|
fs.writeFileSync(tmp, JSON.stringify(settings, null, 2) + '\n');
|
|
fs.renameSync(tmp, settingsPath);
|
|
" 2>/dev/null
|
|
;;
|
|
remove)
|
|
[ -f "$SETTINGS_FILE" ] || exit 0
|
|
GSTACK_SETTINGS_PATH="$SETTINGS_FILE" bun -e "
|
|
const fs = require('fs');
|
|
const settingsPath = process.env.GSTACK_SETTINGS_PATH;
|
|
|
|
let settings = {};
|
|
try { settings = JSON.parse(fs.readFileSync(settingsPath, 'utf8')); } catch { process.exit(0); }
|
|
|
|
if (settings.hooks && settings.hooks.SessionStart) {
|
|
settings.hooks.SessionStart = settings.hooks.SessionStart.filter(entry =>
|
|
!(entry.hooks && entry.hooks.some(h => h.command && h.command.includes('gstack-session-update')))
|
|
);
|
|
if (settings.hooks.SessionStart.length === 0) delete settings.hooks.SessionStart;
|
|
if (Object.keys(settings.hooks).length === 0) delete settings.hooks;
|
|
}
|
|
|
|
const tmp = settingsPath + '.tmp';
|
|
fs.writeFileSync(tmp, JSON.stringify(settings, null, 2) + '\n');
|
|
fs.renameSync(tmp, settingsPath);
|
|
" 2>/dev/null
|
|
;;
|
|
*)
|
|
echo "Unknown action: $ACTION (expected add or remove)" >&2
|
|
exit 1
|
|
;;
|
|
esac
|