fix: replace denylist with allowlist-based EJS template validator @W-23595931@

The regex denylist was bypassable via string concatenation ('exe'+'cSync'),
Array.join(), hex/unicode escapes, template literal interpolation, comment
injection, and tag-boundary injection (%> inside strings).

Replace with a layered allowlist approach (zero new dependencies):
- extractEjsTags: proper tag parser that handles %> in string literals
- normalizeCode: strips JS comments, resolves string concat, decodes escapes
- isSimpleExpression: allowlist for expression tags (identifiers, dot chains,
  safe methods like .replace/.uuid, ternaries, simple bracket access)
- isAllowedScriptlet: allowlist for scriptlet tags (if/else, for...of,
  forEach, variable declarations, closing braces)

Keywords like process/global/require/constructor/__proto__/this are blocked
in ALL contexts regardless of how they're encoded or constructed.

Author: WillieRuemmele

src/generators/baseGenerator.ts

@@ -169,40 +169,368 @@ abstract class NotYeoman {
   }
 }
 
-// Patterns that indicate code execution attempts in EJS tags.
-// Applied to ALL tag types (<% %>, <%= %>, <%- %>) except comments (<%# %>).
-const DANGEROUS_PATTERNS = [
-  /\brequire\s*\(/,
-  /\bimport\s*\(/,
-  /\bchild_process\b/,
-  /\bprocess\s*\.\s*(?:env|exit|kill|binding|dlopen|mainModule|getBuiltinModule)/,
-  /\bglobal\s*\./,
-  /\bglobalThis\s*\./,
-  /\b(?:eval|Function)\s*\(/,
-  /\bexecSync\b/,
-  /\bexec\s*\(/,
-  /\bspawn(?:Sync)?\s*\(/,
-  /\bfs\b\s*\.\s*(?:read|write|unlink|rm|chmod|chown|mkdir|rename|symlink|link)/,
-  /\b__dirname\b/,
-  /\b__filename\b/,
-  /\bmodule\s*\.\s*(?:constructor|_compile|_resolveFilename)/,
-  /\.constructor\s*\.\s*constructor\s*\(/,
-  /\bReflect\s*\.\s*(?:construct|apply)\s*\(/,
-];
+// Allowlist-based validator for custom EJS templates.
+// Instead of trying to block dangerous patterns (infinite bypass surface),
+// we only permit the narrow subset of JS that templates legitimately need.
+
+const ALLOWED_EXPRESSION_CALL_TARGETS = new Set([
+  'replace',
+  'uuid',
+  'join',
+  'toString',
+  'trim',
+  'toLowerCase',
+  'toUpperCase',
+  'slice',
+  'substring',
+  'indexOf',
+  'includes',
+  'split',
+  'concat',
+  'startsWith',
+  'endsWith',
+  'padStart',
+  'padEnd',
+]);
+
+const ALLOWED_SCRIPTLET_METHODS = new Set([
+  'forEach',
+  'map',
+  'filter',
+  'includes',
+  'indexOf',
+  'length',
+  'push',
+  'join',
+  'some',
+  'every',
+  'find',
+  'findIndex',
+  'slice',
+  'concat',
+  'keys',
+  'values',
+  'entries',
+]);
+
+function extractEjsTags(template: string): { type: string; code: string }[] {
+  const tags: { type: string; code: string }[] = [];
+  let i = 0;
+  while (i < template.length) {
+    const start = template.indexOf('<%', i);
+    if (start === -1) {
+      break;
+    }
+
+    const afterOpen = start + 2;
+    if (afterOpen >= template.length) {
+      break;
+    }
+
+    const firstChar = template[afterOpen];
+    if (firstChar === '#') {
+      const end = template.indexOf('%>', afterOpen);
+      i = end === -1 ? template.length : end + 2;
+      continue;
+    }
+
+    let type: string;
+    let codeStart: number;
+    if (firstChar === '=' || firstChar === '-') {
+      type = firstChar;
+      codeStart = afterOpen + 1;
+    } else {
+      type = '%';
+      codeStart = afterOpen;
+    }
+
+    let pos = codeStart;
+    let code = '';
+    let found = false;
+    while (pos < template.length) {
+      const ch = template[pos];
+      if (ch === "'" || ch === '"' || ch === '`') {
+        const quote = ch;
+        pos++;
+        while (pos < template.length && template[pos] !== quote) {
+          if (template[pos] === '\\') {
+            pos++;
+          }
+          pos++;
+        }
+        pos++;
+      } else if (template[pos] === '%' && template[pos + 1] === '>') {
+        code = template.slice(codeStart, pos);
+        found = true;
+        pos += 2;
+        break;
+      } else {
+        pos++;
+      }
+    }
+
+    if (!found) {
+      code = template.slice(codeStart);
+      pos = template.length;
+    }
+
+    tags.push({ type, code: code.trim() });
+    i = pos;
+  }
+  return tags;
+}
+
+function isSafeBracketContent(inner: string): boolean {
+  if (/^\d+$/.test(inner)) {
+    return true;
+  }
+  if (/^[a-zA-Z_$][a-zA-Z0-9_$]*$/.test(inner)) {
+    return true;
+  }
+  const strLitMatch = inner.match(/^(['"])([a-zA-Z_$][\w.]*)\1$/);
+  if (strLitMatch) {
+    return true;
+  }
+  return false;
+}
+
+function containsDangerousBrackets(code: string): boolean {
+  const bracketContent = /\[([^\]]*)\]/g;
+  let m;
+  while ((m = bracketContent.exec(code)) !== null) {
+    if (!isSafeBracketContent(m[1].trim())) {
+      return true;
+    }
+  }
+  return false;
+}
+
+function isSimpleExpression(code: string): boolean {
+  const blocked =
+    /\b(function|class|new|delete|typeof|void|this|process|global|globalThis|require|import|module|eval|Function|constructor|__proto__|prototype|Reflect|Proxy|Object\s*\.\s*(?:create|assign|definePropert|getOwnPropertyNames|getPrototypeOf|setPrototypeOf)|Array\s*\.\s*from|String\s*\.\s*fromCharCode|Symbol|Buffer|setTimeout|setInterval|setImmediate|clearTimeout|clearInterval|queueMicrotask|Promise|async|await|yield|return|throw|try|catch|finally|while|for|do|switch|with)\b/;
+
+  if (blocked.test(code)) {
+    return false;
+  }
+
+  if (containsDangerousBrackets(code)) {
+    return false;
+  }
+
+  if (/`[^`]*\$\{/.test(code)) {
+    return false;
+  }
+
+  if (/(?<![=!<>])=(?!=)/.test(code)) {
+    return false;
+  }
+
+  const callPattern = /\.([a-zA-Z_$][a-zA-Z0-9_$]*)\s*\(/g;
+  let m;
+  while ((m = callPattern.exec(code)) !== null) {
+    if (!ALLOWED_EXPRESSION_CALL_TARGETS.has(m[1])) {
+      return false;
+    }
+  }
+
+  const bareCalls = /(?<![.\w])([a-zA-Z_$][a-zA-Z0-9_$]*)\s*\(/g;
+  while ((m = bareCalls.exec(code)) !== null) {
+    if (!ALLOWED_EXPRESSION_CALL_TARGETS.has(m[1])) {
+      return false;
+    }
+  }
+
+  return true;
+}
+
+function isAllowedScriptlet(code: string): boolean {
+  const statements = code.split(/[;\n]/).map((s) => s.trim()).filter(Boolean);
+
+  for (const stmt of statements) {
+    if (!isAllowedStatement(stmt)) {
+      return false;
+    }
+  }
+  return true;
+}
+
+function isAllowedStatement(stmt: string): boolean {
+  const hardBlocked =
+    /\b(process|global|globalThis|require|import|module|eval|Function|Reflect|Proxy|Buffer|setTimeout|setInterval|setImmediate|clearTimeout|clearInterval|queueMicrotask|__dirname|__filename|constructor|__proto__|prototype|with|yield|async|await)\b/;
+  if (hardBlocked.test(stmt)) {
+    return false;
+  }
+
+  if (/`[^`]*\$\{/.test(stmt)) {
+    return false;
+  }
+
+  if (containsDangerousBrackets(stmt)) {
+    return false;
+  }
+
+  if (/^\}?\s*\)?\s*;?\s*\}?\s*;?$/.test(stmt)) {
+    return true;
+  }
+
+  if (stmt === '{') {
+    return true;
+  }
+
+  if (/^(?:else\s+)?if\s*\(/.test(stmt)) {
+    return isSimpleCondition(stmt);
+  }
+  if (/^}\s*else\s*\{?$/.test(stmt) || stmt === 'else {' || stmt === 'else') {
+    return true;
+  }
+
+  if (/^for\s*\(/.test(stmt)) {
+    return isSimpleForLoop(stmt);
+  }
+
+  if (/^\w[\w.]*\s*\.\s*(forEach|map|filter|some|every|find|findIndex)\s*\(/.test(stmt)) {
+    return isSimpleIterator(stmt);
+  }
+
+  if (/^(?:const|let|var)\s+/.test(stmt)) {
+    return isSimpleDeclaration(stmt);
+  }
+
+  if (/^[a-zA-Z_$][\w.]*\s*\.\s*(push|pop|shift|unshift)\s*\(/.test(stmt)) {
+    return isSimpleMethodCall(stmt);
+  }
+
+  return false;
+}
+
+function isSimpleCondition(stmt: string): boolean {
+  const condMatch = stmt.match(/^(?:else\s+)?if\s*\(([\s\S]*)\)\s*\{?\s*$/);
+  if (!condMatch) {
+    return false;
+  }
+  const cond = condMatch[1];
+  const hardBlocked =
+    /\b(process|global|globalThis|require|import|module|eval|Function|Reflect|Proxy|constructor|__proto__)\b/;
+  if (hardBlocked.test(cond)) {
+    return false;
+  }
+  if (/`[^`]*\$\{/.test(cond)) {
+    return false;
+  }
+  const callPattern = /\.([a-zA-Z_$]\w*)\s*\(/g;
+  let m;
+  while ((m = callPattern.exec(cond)) !== null) {
+    if (!ALLOWED_SCRIPTLET_METHODS.has(m[1])) {
+      return false;
+    }
+  }
+  if (containsDangerousBrackets(cond)) {
+    return false;
+  }
+  return true;
+}
+
+function isSimpleForLoop(stmt: string): boolean {
+  if (/^for\s*\(\s*(?:const|let|var)\s+\[?\s*\w+(?:\s*,\s*\w+)*\s*\]?\s+(?:of|in)\s+/.test(stmt)) {
+    const hardBlocked = /\b(process|global|globalThis|require|import|module|eval|Function|Reflect|Proxy|constructor|__proto__)\b/;
+    return !hardBlocked.test(stmt);
+  }
+  return false;
+}
+
+function isSimpleIterator(stmt: string): boolean {
+  const hardBlocked =
+    /\b(process|global|globalThis|require|import|module|eval|Function|Reflect|Proxy|constructor|__proto__)\b/;
+  if (hardBlocked.test(stmt)) {
+    return false;
+  }
+  if (/`[^`]*\$\{/.test(stmt)) {
+    return false;
+  }
+  if (containsDangerousBrackets(stmt)) {
+    return false;
+  }
+  return true;
+}
+
+function isSimpleDeclaration(stmt: string): boolean {
+  const hardBlocked =
+    /\b(process|global|globalThis|require|import|module|eval|Function|Reflect|Proxy|constructor|__proto__|prototype)\b/;
+  if (hardBlocked.test(stmt)) {
+    return false;
+  }
+  if (/`[^`]*\$\{/.test(stmt)) {
+    return false;
+  }
+  if (/\bfunction\b/.test(stmt)) {
+    return false;
+  }
+  if (/=>\s*\{/.test(stmt)) {
+    return false;
+  }
+  if (containsDangerousBrackets(stmt)) {
+    return false;
+  }
+  return true;
+}
+
+function isSimpleMethodCall(stmt: string): boolean {
+  const hardBlocked =
+    /\b(process|global|globalThis|require|import|module|eval|Function|Reflect|Proxy|constructor|__proto__)\b/;
+  if (hardBlocked.test(stmt)) {
+    return false;
+  }
+  if (/`[^`]*\$\{/.test(stmt)) {
+    return false;
+  }
+  if (containsDangerousBrackets(stmt)) {
+    return false;
+  }
+  return true;
+}
+
+function normalizeCode(code: string): string {
+  let result = code;
+  // Strip JS comments that could hide content from analysis
+  result = result.replace(/\/\*[\s\S]*?\*\//g, ' ');
+  result = result.replace(/\/\/[^\n]*/g, ' ');
+  // Resolve string concatenations: 'a' + 'b' -> 'ab'
+  let prev = '';
+  while (result !== prev) {
+    prev = result;
+    result = result.replace(/'([^'\\]*)'\s*\+\s*'([^'\\]*)'/g, "'$1$2'");
+    result = result.replace(/"([^"\\]*)"\s*\+\s*"([^"\\]*)"/g, '"$1$2"');
+    result = result.replace(/'([^'\\]*)'\s*\+\s*"([^"\\]*)"/g, "'$1$2'");
+    result = result.replace(/"([^"\\]*)"\s*\+\s*'([^'\\]*)'/g, '"$1$2"');
+  }
+  // Normalize hex escapes in strings: '\x63' -> 'c'
+  result = result.replace(/\\x([0-9a-fA-F]{2})/g, (_, hex) =>
+    String.fromCharCode(parseInt(hex, 16))
+  );
+  // Normalize unicode escapes: '\u0063' -> 'c'
+  result = result.replace(/\\u([0-9a-fA-F]{4})/g, (_, hex) =>
+    String.fromCharCode(parseInt(hex, 16))
+  );
+  return result;
+}
 
 export function validateCustomTemplate(
   templateContent: string,
   templatePath: string
 ): void {
-  // Match all EJS tags EXCEPT comments (<%# ... %>)
-  const ejsTagRegex = /<%(?!#)[\s\S]*?%>/g;
-  let match;
-  while ((match = ejsTagRegex.exec(templateContent)) !== null) {
-    const code = match[0];
-    for (const pattern of DANGEROUS_PATTERNS) {
-      if (pattern.test(code)) {
+  const tags = extractEjsTags(templateContent);
+  for (const tag of tags) {
+    const code = normalizeCode(tag.code);
+    if (tag.type === '=' || tag.type === '-') {
+      if (!isSimpleExpression(code)) {
+        throw new Error(
+          `Custom template "${templatePath}" contains disallowed code in expression tag: ${tag.code.slice(0, 80)}`
+        );
+      }
+    } else {
+      if (!isAllowedScriptlet(code)) {
         throw new Error(
-          `Custom template "${templatePath}" contains disallowed code execution pattern: ${pattern.source}`
+          `Custom template "${templatePath}" contains disallowed code in scriptlet tag: ${tag.code.slice(0, 80)}`
         );
       }
     }