fix: validate custom templates for dangerous code execution patterns @W-23595931@

Defense-in-depth: scan EJS scriptlet blocks in custom templates for
dangerous patterns (require, import, child_process, eval, etc.) before
rendering. Built-in templates are trusted and not scanned.

This prevents arbitrary code execution even if a user's global config
points to a compromised template directory.

Author: WillieRuemmele

src/generators/baseGenerator.ts

@@ -169,6 +169,42 @@ abstract class NotYeoman {
   }
 }
 
+// Patterns that indicate code execution attempts in EJS scriptlet blocks
+const DANGEROUS_PATTERNS = [
+  /\brequire\s*\(/,
+  /\bimport\s*\(/,
+  /\bchild_process\b/,
+  /\bprocess\s*\.\s*(?:env|exit|kill|binding|dlopen|mainModule)/,
+  /\bglobal\s*\./,
+  /\bglobalThis\s*\./,
+  /\b(?:eval|Function)\s*\(/,
+  /\bexecSync\b/,
+  /\bexec\s*\(/,
+  /\bspawn(?:Sync)?\s*\(/,
+  /\bfs\b\s*\.\s*(?:read|write|unlink|rm|chmod|chown|mkdir|rename|symlink|link)/,
+  /\b__dirname\b/,
+  /\b__filename\b/,
+  /\bmodule\s*\.\s*(?:constructor|_compile|_resolveFilename)/,
+];
+
+export function validateCustomTemplate(
+  templateContent: string,
+  templatePath: string
+): void {
+  const scriptletRegex = /<%(?![-=#])[\s\S]*?%>/g;
+  let match;
+  while ((match = scriptletRegex.exec(templateContent)) !== null) {
+    const code = match[0];
+    for (const pattern of DANGEROUS_PATTERNS) {
+      if (pattern.test(code)) {
+        throw new Error(
+          `Custom template "${templatePath}" contains disallowed code execution pattern: ${pattern.source}`
+        );
+      }
+    }
+  }
+}
+
 export abstract class BaseGenerator<
   TOptions extends TemplateOptions
 > extends NotYeoman {
@@ -237,6 +273,18 @@ export abstract class BaseGenerator<
     }
   }
 
+  public async render(
+    source: string,
+    destination: string,
+    data?: Record<string, unknown>
+  ): Promise<void> {
+    if (this.customTemplatesRootPath && source.startsWith(this.customTemplatesRootPath)) {
+      const template = await this._fs.promises.readFile(source, 'utf8');
+      validateCustomTemplate(template, source);
+    }
+    return super.render(source, destination, data);
+  }
+
   public async run(opts?: {
     cwd?: string;
     customTemplatesRootPathOrGitRepo?: string;

src/index.ts

@@ -7,6 +7,7 @@
 
 import { TemplateService } from './service/templateService';
 export { TemplateService };
+export { validateCustomTemplate } from './generators/baseGenerator';
 export * from './utils/types';
 export * from './utils/createUtil';
 export * from './utils/uiEmbedding';

test/generators/baseGenerator.test.ts

@@ -11,6 +11,7 @@ import { TemplateOptions } from '../../src';
 import {
   BaseGenerator,
   getDefaultApiVersion,
+  validateCustomTemplate,
 } from '../../src/generators/baseGenerator';
 
 describe('BaseGenerator', () => {
@@ -60,3 +61,79 @@ describe('BaseGenerator', () => {
     expect(validateOptionsStub.calledOnce).to.be.true;
   });
 });
+
+describe('validateCustomTemplate', () => {
+  it('should allow safe interpolation-only templates', () => {
+    const template = 'public class <%= apiName %> {\n}';
+    expect(() => validateCustomTemplate(template, 'test.cls')).to.not.throw();
+  });
+
+  it('should allow safe control flow in scriptlet tags', () => {
+    const template = '<% if (primaryField) { %>\n<%= primaryField %>\n<% } %>';
+    expect(() => validateCustomTemplate(template, 'test.xml')).to.not.throw();
+  });
+
+  it('should allow forEach loops', () => {
+    const template = '<% fields.forEach((field) => { %>\n<%= field %>\n<% }); %>';
+    expect(() => validateCustomTemplate(template, 'test.xml')).to.not.throw();
+  });
+
+  it('should block require() calls', () => {
+    const template = '<% require("child_process").execSync("calc") %>';
+    expect(() => validateCustomTemplate(template, 'malicious.cls')).to.throw(
+      'disallowed code execution pattern'
+    );
+  });
+
+  it('should block dynamic import()', () => {
+    const template = '<% const m = await import("fs") %>';
+    expect(() => validateCustomTemplate(template, 'malicious.cls')).to.throw(
+      'disallowed code execution pattern'
+    );
+  });
+
+  it('should block process.env access', () => {
+    const template = '<% process.env.SECRET %>';
+    expect(() => validateCustomTemplate(template, 'malicious.cls')).to.throw(
+      'disallowed code execution pattern'
+    );
+  });
+
+  it('should block eval()', () => {
+    const template = '<% eval("malicious code") %>';
+    expect(() => validateCustomTemplate(template, 'malicious.cls')).to.throw(
+      'disallowed code execution pattern'
+    );
+  });
+
+  it('should block Function constructor', () => {
+    const template = '<% Function("return process")() %>';
+    expect(() => validateCustomTemplate(template, 'malicious.cls')).to.throw(
+      'disallowed code execution pattern'
+    );
+  });
+
+  it('should block execSync', () => {
+    const template = '<% execSync("whoami") %>';
+    expect(() => validateCustomTemplate(template, 'malicious.cls')).to.throw(
+      'disallowed code execution pattern'
+    );
+  });
+
+  it('should block globalThis access', () => {
+    const template = '<% globalThis.process %>';
+    expect(() => validateCustomTemplate(template, 'malicious.cls')).to.throw(
+      'disallowed code execution pattern'
+    );
+  });
+
+  it('should not flag output tags containing dangerous-looking strings', () => {
+    const template = '<%= "require something" %>';
+    expect(() => validateCustomTemplate(template, 'test.cls')).to.not.throw();
+  });
+
+  it('should not flag comment tags', () => {
+    const template = '<%# require("fs") %>';
+    expect(() => validateCustomTemplate(template, 'test.cls')).to.not.throw();
+  });
+});