From 3b92304115ccef1594cfa8d768beae1b26be6db1 Mon Sep 17 00:00:00 2001 From: M3gA-Mind Date: Fri, 23 Oct 2026 04:33:54 +0530 Subject: [PATCH] fix(run_linter): refuse an option-shaped eslint path --- .../src/filesystem/run_linter/mod.rs | 5 +++++ .../src/filesystem/run_linter/mod_tests.rs | 15 +++++++++++++++ 2 files changed, 20 insertions(+) diff --git a/crates/tinytools-std/src/filesystem/run_linter/mod.rs b/crates/tinytools-std/src/filesystem/run_linter/mod.rs index b9c55aaa..857f55e5 100644 --- a/crates/tinytools-std/src/filesystem/run_linter/mod.rs +++ b/crates/tinytools-std/src/filesystem/run_linter/mod.rs @@ -121,6 +121,11 @@ impl Tool for RunLinterTool { (no absolute paths or '..')", )); } + // A value starting with `-` would reach eslint as an option + // (`--output-file=` writes a file). No path needs one. + if path.starts_with('-') { + return Ok(ToolResult::error("path must be a path, not an option")); + } let mut cmd = tokio::process::Command::new("npx"); cmd.args(["eslint", "--format", "compact", path]) .current_dir(&workspace_dir); diff --git a/crates/tinytools-std/src/filesystem/run_linter/mod_tests.rs b/crates/tinytools-std/src/filesystem/run_linter/mod_tests.rs index 5a05573d..2fb8012e 100644 --- a/crates/tinytools-std/src/filesystem/run_linter/mod_tests.rs +++ b/crates/tinytools-std/src/filesystem/run_linter/mod_tests.rs @@ -95,3 +95,18 @@ async fn a_workspace_descriptor_overrides_the_configured_directory() { assert!(result.is_error); assert!(result.output().contains("Could not detect project type")); } + +// A path starting with `-` would reach eslint as an option +// (`--output-file=` writes a file). No path needs a leading `-`. +#[tokio::test] +async fn eslint_rejects_an_option_shaped_path() { + let tmp = TempDir::new().unwrap(); + std::fs::write(tmp.path().join("package.json"), "{}").unwrap(); + let result = make_tool(&tmp) + .execute(json!({"linter": "eslint", "path": "--output-file=pwned.txt"})) + .await + .unwrap(); + assert!(result.is_error); + assert!(result.output().contains("not an option")); + assert!(!tmp.path().join("pwned.txt").exists()); +}