Reject paths in theme package filenames

Author: gonzaloriestra

packages/theme/src/cli/commands/theme/package.test.ts

@@ -8,6 +8,9 @@ import {joinPath, relativizePath, cwd} from '@shopify/cli-kit/node/path'
 import {withCapturedStandardStreams} from '@shopify/cli-kit/node/testing/output'
 import {renderSuccess} from '@shopify/cli-kit/node/ui'
 import {expect, test, vi} from 'vitest'
+// Native JSON paths must preserve Windows separators instead of pathe normalization.
+// eslint-disable-next-line no-restricted-imports
+import {resolve as nativePath} from 'node:path'
 
 vi.mock('@shopify/cli-kit/node/ui')
 vi.mock('@shopify/cli-kit/node/analytics')
@@ -31,7 +34,7 @@ test.each([true, false])('writes the package receipt to stdout with version=%s',
 
     await withCapturedStandardStreams(async ({stdout, stderr}) => {
       await runWithCommandEventsForCommand(['--json'], () => run(['--path', directory, '--json']))
-      expect(stdout()).toBe(`${themePackageJsonOutputSchema.encode({path})}\n`)
+      expect(stdout()).toBe(`${themePackageJsonOutputSchema.encode({path: nativePath(path)})}\n`)
       expect(stderr()).toBe('')
     })
     await expect(fileExists(path)).resolves.toBe(true)

packages/theme/src/cli/services/package.test.ts

@@ -9,6 +9,33 @@ const StreamZip = require('node-stream-zip')
 vi.mock('@shopify/cli-kit/node/ui')
 
 describe('packageTheme', () => {
+  test.each([
+    {name: '../outside', version: ''},
+    {name: 'absolute', version: ''},
+    {name: 'C:\\outside', version: ''},
+    {name: 'C:outside', version: ''},
+    {name: 'Dawn', version: '../outside'},
+    {name: 'Dawn', version: '..\\outside'},
+  ])('rejects paths in the package filename: %j', async ({name, version}) => {
+    await inTemporaryDirectory(async (tmpDir) => {
+      const inputDirectory = joinPath(tmpDir, 'theme')
+      await mkdir(joinPath(inputDirectory, 'config'))
+      await createSettingsSchema(
+        JSON.stringify([
+          {
+            name: 'theme_info',
+            theme_name: name === 'absolute' ? joinPath(tmpDir, 'outside') : name,
+            theme_version: version,
+          },
+        ]),
+        inputDirectory,
+      )
+
+      await expect(packageTheme(inputDirectory)).rejects.toThrow('Theme name and version must not contain paths.')
+      await expect(fileExists(joinPath(tmpDir, 'outside.zip'))).resolves.toBe(false)
+    })
+  })
+
   test('creates zip file from theme', async () => {
     await inTemporaryDirectory(async (tmpDir) => {
       // Given

packages/theme/src/cli/services/package.ts

@@ -53,6 +53,10 @@ async function getThemePackageName(inputDirectory: string) {
 
   const themeNameVersion = [themeInfo.theme_name, themeInfo.theme_version].filter(Boolean).join('-')
 
+  if (/[/\\]/.test(themeNameVersion) || /^[a-z]:/i.test(themeNameVersion)) {
+    throw new AbortError('Theme name and version must not contain paths.')
+  }
+
   return `${themeNameVersion}.zip`
 }
 

packages/theme/src/cli/services/package/result.ts

@@ -2,10 +2,13 @@ import {themePackageJsonOutputSchema, type ThemePackageResult} from './types.js'
 import {outputResult} from '@shopify/cli-kit/node/output'
 import {relativizePath} from '@shopify/cli-kit/node/path'
 import {renderSuccess} from '@shopify/cli-kit/node/ui'
+// Native JSON paths must preserve Windows separators instead of pathe normalization.
+// eslint-disable-next-line no-restricted-imports
+import {resolve as resolvePath} from 'node:path'
 
 export function renderThemePackageResult(result: ThemePackageResult, format: 'text' | 'json'): void {
   if (format === 'json') {
-    outputResult(themePackageJsonOutputSchema.encode(result))
+    outputResult(themePackageJsonOutputSchema.encode({...result, path: resolvePath(result.path)}))
     return
   }