Fix YAML serialization, file validation, and documentation issues

justin808 · claude · justin808 · commit 4062ada1f0b1 · 2025-10-07T20:01:28.000-10:00
**YAML Serialization Fixes:** - Fix multiline string values under object keys to use proper block scalar (|) syntax - Multiline strings in objects now properly indented with valueIndent **File Security & Validation:** - Add basename() sanitization to prevent path traversal in writeMultipleFiles - Call validateOutputPath() in both writeSingleFile and writeMultipleFiles - Ensure filenames cannot escape target directory **Documentation:** - Add bash language hint to code fence at line 78 (fixes MD040 markdownlint warning) All changes address issues identified in code review while maintaining backward compatibility. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
diff --git a/docs/troubleshooting.md b/docs/troubleshooting.md
@@ -75,7 +75,7 @@
 
 6. Generate webpack stats for build analysis (useful for bundle size optimization):
 
-   ```
+   ```bash
    NODE_ENV=development bin/shakapacker --profile --json > /tmp/webpack-stats.json
    ```
 
diff --git a/package/configExporter/fileWriter.ts b/package/configExporter/fileWriter.ts
@@ -1,5 +1,5 @@
 import { writeFileSync, mkdirSync, existsSync } from "fs"
-import { resolve, dirname, relative, isAbsolute } from "path"
+import { resolve, dirname, relative, isAbsolute, basename } from "path"
 import { tmpdir } from "os"
 import { FileOutput } from "./types"
 
@@ -17,7 +17,9 @@ export class FileWriter {
 
     // Write each file
     outputs.forEach((output) => {
-      const filePath = resolve(targetDir, output.filename)
+      const safeName = basename(output.filename)
+      const filePath = resolve(targetDir, safeName)
+      this.validateOutputPath(filePath)
       this.writeFile(filePath, output.content)
       console.log(`[Config Exporter] Created: ${filePath}`)
     })
@@ -35,6 +37,7 @@ export class FileWriter {
     const dir = dirname(filePath)
     this.ensureDirectory(dir)
 
+    this.validateOutputPath(filePath)
     this.writeFile(filePath, content)
     console.log(`[Config Exporter] Config exported to: ${filePath}`)
   }
diff --git a/package/configExporter/yamlSerializer.ts b/package/configExporter/yamlSerializer.ts
@@ -184,10 +184,13 @@ export class YamlSerializer {
         }
       }
 
-      const serialized = this.serializeValue(value, indent + 2, fullKeyPath)
-
-      // Handle nested objects and arrays differently
-      if (
+      // Handle multiline strings specially with block scalar
+      if (typeof value === "string" && value.includes("\n")) {
+        lines.push(`${keyIndent}${key}: |`)
+        for (const line of value.split("\n")) {
+          lines.push(`${valueIndent}${line}`)
+        }
+      } else if (
         typeof value === "object" &&
         value !== null &&
         !Array.isArray(value)
@@ -212,6 +215,7 @@ export class YamlSerializer {
           lines.push(arrayLines)
         }
       } else {
+        const serialized = this.serializeValue(value, indent + 2, fullKeyPath)
         lines.push(`${keyIndent}${key}: ${serialized}`)
       }
     })

Original file line number	Diff line number	Diff line change
`@@ -184,10 +184,13 @@ export class YamlSerializer {`
`184`	`184`	`}`
`185`	`185`	`}`
`186`	`186`
`187`		`- const serialized = this.serializeValue(value, indent + 2, fullKeyPath)`
`188`		`-`
`189`		`- // Handle nested objects and arrays differently`
`190`		`- if (`
	`187`	`+ // Handle multiline strings specially with block scalar`
	`188`	`+ if (typeof value === "string" && value.includes("\n")) {`
	`189`	+ lines.push(`${keyIndent}${key}: \|`)
	`190`	`+ for (const line of value.split("\n")) {`
	`191`	+ lines.push(`${valueIndent}${line}`)
	`192`	`+ }`
	`193`	`+ } else if (`
`191`	`194`	`typeof value === "object" &&`
`192`	`195`	`value !== null &&`
`193`	`196`	`!Array.isArray(value)`
`@@ -212,6 +215,7 @@ export class YamlSerializer {`
`212`	`215`	`lines.push(arrayLines)`
`213`	`216`	`}`
`214`	`217`	`} else {`
	`218`	`+ const serialized = this.serializeValue(value, indent + 2, fullKeyPath)`
`215`	`219`	lines.push(`${keyIndent}${key}: ${serialized}`)
`216`	`220`	`}`
`217`	`221`	`})`