fix: Sanitize manifest propererty values before interpolation

Fixes #2119
mozilla · Apr 13, 2021 · cba63e9 · cba63e9
1 parent 146770f
commit cba63e9
Show file tree

Hide file tree

Showing 3 changed files with 24 additions and 1 deletion.
diff --git a/src/cmd/build.js b/src/cmd/build.js
@@ -132,7 +132,8 @@ function getPackageNameFromTemplate(
   const packageName = filenameTemplate.replace(
     /{([A-Za-z0-9._]+?)}/g,
     (match, manifestProperty) => {
-      return getStringPropertyValue(manifestProperty, manifestData);
+      return safeFileName(
+        getStringPropertyValue(manifestProperty, manifestData));
     }
   );
 

diff --git a/tests/fixtures/slashed-name/manifest.json b/tests/fixtures/slashed-name/manifest.json
@@ -0,0 +1,6 @@
+{
+    "name": "Name w/o slash \\o/",
+    "description": "ends with.zip",
+    "version": "1",
+    "manifest_version": 2
+}
diff --git a/tests/unit/test-cmd/test.build.js b/tests/unit/test-cmd/test.build.js
@@ -121,6 +121,22 @@ describe('build', () => {
     );
   });
 
+  it('sanitizes characters in extension name in filename from template', () => {
+    return withTempDir(
+      (tmpDir) =>
+        build({
+          sourceDir: fixturePath('slashed-name'),
+          artifactsDir: tmpDir.path(),
+          // name contains a slash. description ends with ".zip".
+          filename: 'prefix-{name}{description}',
+        })
+          .then((buildResult) => {
+            assert.match(buildResult.extensionPath,
+                         /prefix-name_w_o_slash_o_ends_with\.zip$/);
+          })
+    );
+  });
+
   it('throws an error if the filename contains a path', () => {
     return withTempDir(
       (tmpDir) =>