From 7560fe90c8c322e968f40da432970efa8f74e5c8 Mon Sep 17 00:00:00 2001 From: Toshihiko SHIMOKAWA Date: Fri, 10 Jul 2026 10:55:14 +0900 Subject: [PATCH 1/4] feat: allow overriding the latex-environment source org/repo (#32) aldc hardcoded smkwlab/latex-environment as the devcontainer source, so other orgs had to edit the script to distribute their own fork. Make the source configurable while preserving the smkwlab default. - REPOSITORY_OWNER / REPOSITORY_NAME now read ALDC_REPOSITORY_OWNER / ALDC_REPOSITORY_NAME (defaults smkwlab / latex-environment). - Validate both against the GitHub login / repository character set, since the repo name is also used as the extracted directory in cd and rm -rf. - Document the variables in --help and the Development guide. The release branch name stays fixed by convention. --- aldc | 25 ++++++++++++++++++++++--- docs/CLAUDE-DEVELOPMENT.md | 16 ++++++++++++++-- 2 files changed, 36 insertions(+), 5 deletions(-) diff --git a/aldc b/aldc index 3921be0..7e04062 100755 --- a/aldc +++ b/aldc @@ -1,8 +1,25 @@ #! /bin/bash # aldc: Add LaTeX DevContainer -REPOSITORY_NAME='latex-environment' -REPOSITORY_OWNER='smkwlab' +# Source of the LaTeX devcontainer. Defaults to smkwlab/latex-environment; +# other orgs can point aldc at their own fork via these env vars. +REPOSITORY_NAME="${ALDC_REPOSITORY_NAME:-latex-environment}" +REPOSITORY_OWNER="${ALDC_REPOSITORY_OWNER:-smkwlab}" +# owner/repo are embedded in the download URL and, more importantly, used as the +# extracted directory in `cd` and `rm -rf` below, so validate the character set +# (GitHub login / repository name) to avoid accidents from a mistyped value. +case "$REPOSITORY_OWNER" in + ''|*[!A-Za-z0-9-]*) + echo "Error: invalid ALDC_REPOSITORY_OWNER: ${REPOSITORY_OWNER}" >&2 + exit 1 + ;; +esac +case "$REPOSITORY_NAME" in + ''|*[!A-Za-z0-9._-]*) + echo "Error: invalid ALDC_REPOSITORY_NAME: ${REPOSITORY_NAME}" >&2 + exit 1 + ;; +esac REPOSITORY_URL="https://github.com/${REPOSITORY_OWNER}/${REPOSITORY_NAME}" BRANCH='release' ZIP_NAME="${REPOSITORY_NAME}-${BRANCH}.zip" @@ -41,7 +58,9 @@ while [ $# -gt 0 ]; do echo " --help, -h Show this help message" echo "" echo "Environment Variables:" - echo " ALDC_QUIET=1 Enable quiet mode" + echo " ALDC_QUIET=1 Enable quiet mode" + echo " ALDC_REPOSITORY_OWNER Source org/user (default: smkwlab)" + echo " ALDC_REPOSITORY_NAME Source repo (default: latex-environment)" exit 0 ;; *) diff --git a/docs/CLAUDE-DEVELOPMENT.md b/docs/CLAUDE-DEVELOPMENT.md index 74ebaff..18160af 100644 --- a/docs/CLAUDE-DEVELOPMENT.md +++ b/docs/CLAUDE-DEVELOPMENT.md @@ -10,10 +10,22 @@ This document covers the development workflow, architecture, and technical detai - **Git Integration**: Automatic repository initialization and commit handling ### Environment Source -- **Source Repository**: smkwlab/latex-environment +- **Source Repository**: smkwlab/latex-environment (default) - **Branch**: release (stable releases) - **Installation Method**: Downloads ZIP, extracts, and integrates files +The source is overridable for other-org deployments (defaults preserve +smkwlab behavior): + +| Variable | Default | Purpose | +|----------|---------|---------| +| `ALDC_REPOSITORY_OWNER` | `smkwlab` | Org/user hosting the latex-environment fork. | +| `ALDC_REPOSITORY_NAME` | `latex-environment` | Repository name to download. | + +Both are validated against the GitHub login / repository character set before +being used in the download URL and the extracted directory (`cd` / `rm -rf`). +The release branch name is fixed to `release` by convention. + ## Installation Process ### Process Flow @@ -65,7 +77,7 @@ texlive-ja-textlint (Docker base image) ## Configuration Details ### Default Settings -- **Repository**: smkwlab/latex-environment +- **Repository**: smkwlab/latex-environment (override with `ALDC_REPOSITORY_OWNER` / `ALDC_REPOSITORY_NAME`) - **Branch**: release (for stability) - **Installation Location**: Current working directory - **Backup Strategy**: Conflicts renamed with `-aldc` suffix From acf04952bed30fb51548d0d5ff29653737a59a63 Mon Sep 17 00:00:00 2001 From: Toshihiko SHIMOKAWA Date: Fri, 10 Jul 2026 10:57:51 +0900 Subject: [PATCH 2/4] fix: reject dot-traversal names and align help columns (#32) AI review feedback on PR #33: - REPOSITORY_NAME validation allowed dots, so "." and ".." (and any ".." sequence) passed. Reject them explicitly to harden the cd / rm -rf paths. - Align the Environment Variables help columns. --- aldc | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/aldc b/aldc index 7e04062..61d4ee6 100755 --- a/aldc +++ b/aldc @@ -15,7 +15,7 @@ case "$REPOSITORY_OWNER" in ;; esac case "$REPOSITORY_NAME" in - ''|*[!A-Za-z0-9._-]*) + ''|.|*..*|*[!A-Za-z0-9._-]*) echo "Error: invalid ALDC_REPOSITORY_NAME: ${REPOSITORY_NAME}" >&2 exit 1 ;; @@ -58,7 +58,7 @@ while [ $# -gt 0 ]; do echo " --help, -h Show this help message" echo "" echo "Environment Variables:" - echo " ALDC_QUIET=1 Enable quiet mode" + echo " ALDC_QUIET=1 Enable quiet mode" echo " ALDC_REPOSITORY_OWNER Source org/user (default: smkwlab)" echo " ALDC_REPOSITORY_NAME Source repo (default: latex-environment)" exit 0 From 5ae356aa439366d42ab86e3f48cf692eb4f78094 Mon Sep 17 00:00:00 2001 From: Toshihiko SHIMOKAWA Date: Fri, 10 Jul 2026 11:02:47 +0900 Subject: [PATCH 3/4] fix: reject leading-dash owner/repo and correct validation rationale (#32) Second round of AI review feedback on PR #33: - A leading dash in REPOSITORY_OWNER/REPOSITORY_NAME survived validation and, via cd/rm on "${REPOSITORY_NAME}-${BRANCH}", is parsed as an option even when quoted (rm errors with "invalid option"). Reject leading "-" in both. - Correct the code comment and dev-doc: only REPOSITORY_NAME is used as the extracted directory (cd / rm -rf); REPOSITORY_OWNER appears only in the URL. --- aldc | 12 +++++++----- docs/CLAUDE-DEVELOPMENT.md | 8 +++++--- 2 files changed, 12 insertions(+), 8 deletions(-) diff --git a/aldc b/aldc index 61d4ee6..50f3a37 100755 --- a/aldc +++ b/aldc @@ -5,17 +5,19 @@ # other orgs can point aldc at their own fork via these env vars. REPOSITORY_NAME="${ALDC_REPOSITORY_NAME:-latex-environment}" REPOSITORY_OWNER="${ALDC_REPOSITORY_OWNER:-smkwlab}" -# owner/repo are embedded in the download URL and, more importantly, used as the -# extracted directory in `cd` and `rm -rf` below, so validate the character set -# (GitHub login / repository name) to avoid accidents from a mistyped value. +# REPOSITORY_OWNER goes into the download URL; REPOSITORY_NAME is additionally +# used as the extracted directory in `cd` / `rm -rf` below. Validate both: +# the GitHub login / repository character set, no leading dash (a leading `-` +# would be parsed as an option by cd/rm even when quoted), and — for the name — +# no dot-only / `..` traversal value. case "$REPOSITORY_OWNER" in - ''|*[!A-Za-z0-9-]*) + ''|-*|*[!A-Za-z0-9-]*) echo "Error: invalid ALDC_REPOSITORY_OWNER: ${REPOSITORY_OWNER}" >&2 exit 1 ;; esac case "$REPOSITORY_NAME" in - ''|.|*..*|*[!A-Za-z0-9._-]*) + ''|.|-*|*..*|*[!A-Za-z0-9._-]*) echo "Error: invalid ALDC_REPOSITORY_NAME: ${REPOSITORY_NAME}" >&2 exit 1 ;; diff --git a/docs/CLAUDE-DEVELOPMENT.md b/docs/CLAUDE-DEVELOPMENT.md index 18160af..e243f65 100644 --- a/docs/CLAUDE-DEVELOPMENT.md +++ b/docs/CLAUDE-DEVELOPMENT.md @@ -22,9 +22,11 @@ smkwlab behavior): | `ALDC_REPOSITORY_OWNER` | `smkwlab` | Org/user hosting the latex-environment fork. | | `ALDC_REPOSITORY_NAME` | `latex-environment` | Repository name to download. | -Both are validated against the GitHub login / repository character set before -being used in the download URL and the extracted directory (`cd` / `rm -rf`). -The release branch name is fixed to `release` by convention. +`ALDC_REPOSITORY_OWNER` is used only in the download URL; `ALDC_REPOSITORY_NAME` +is additionally used as the extracted directory in `cd` / `rm -rf`. Both are +validated (GitHub character set, no leading dash, and — for the name — no `.` +or `..` traversal) before use. The release branch name is fixed to `release` +by convention. ## Installation Process From 06751a14ee34fe6018a94a8be98f9d143353a2ac Mon Sep 17 00:00:00 2001 From: Toshihiko SHIMOKAWA Date: Fri, 10 Jul 2026 11:07:13 +0900 Subject: [PATCH 4/4] fix: narrow name validation and correct the security note (#32) Third round of AI review feedback on PR #33: - Reject only the exact traversal names "." and ".." rather than any value containing ".." (*..*). Since "/" is already rejected, an embedded ".." such as "foo..bar" cannot form a path component, so blocking it was over-strict. - Update the Security Considerations note: the source is no longer smkwlab-only but overridable via ALDC_REPOSITORY_OWNER/NAME (character-validated). --- aldc | 2 +- docs/CLAUDE-DEVELOPMENT.md | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/aldc b/aldc index 50f3a37..67f6533 100755 --- a/aldc +++ b/aldc @@ -17,7 +17,7 @@ case "$REPOSITORY_OWNER" in ;; esac case "$REPOSITORY_NAME" in - ''|.|-*|*..*|*[!A-Za-z0-9._-]*) + ''|.|..|-*|*[!A-Za-z0-9._-]*) echo "Error: invalid ALDC_REPOSITORY_NAME: ${REPOSITORY_NAME}" >&2 exit 1 ;; diff --git a/docs/CLAUDE-DEVELOPMENT.md b/docs/CLAUDE-DEVELOPMENT.md index e243f65..4be2614 100644 --- a/docs/CLAUDE-DEVELOPMENT.md +++ b/docs/CLAUDE-DEVELOPMENT.md @@ -113,7 +113,9 @@ texlive-ja-textlint (Docker base image) ## Security Considerations -- Downloads from official smkwlab repository only +- Downloads from smkwlab/latex-environment by default; the source is + overridable via `ALDC_REPOSITORY_OWNER`/`ALDC_REPOSITORY_NAME`, which are + character-validated (no path separators, leading dash, or `.`/`..`) - Uses HTTPS for all network communications - No external dependencies beyond standard unix tools - Repository verification through GitHub's infrastructure