Skip to content

feat: allow overriding the latex-environment source org/repo (#32) #33

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
toshi0806 merged 4 commits into from
Jul 10, 2026
Merged

feat: allow overriding the latex-environment source org/repo (#32) #33

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
7560fe9
feat: allow overriding the latex-environment source org/repo (#32)
toshi0806 Jul 10, 2026
acf0495
fix: reject dot-traversal names and align help columns (#32)
toshi0806 Jul 10, 2026
5ae356a
fix: reject leading-dash owner/repo and correct validation rationale …
toshi0806 Jul 10, 2026
06751a1
fix: narrow name validation and correct the security note (#32)
toshi0806 Jul 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 24 additions & 3 deletions aldc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,27 @@
#! /bin/bash
# aldc: Add LaTeX DevContainer

REPOSITORY_NAME='latex-environment'
REPOSITORY_OWNER='smkwlab'
# Source of the LaTeX devcontainer. Defaults to smkwlab/latex-environment;
# other orgs can point aldc at their own fork via these env vars.
REPOSITORY_NAME="${ALDC_REPOSITORY_NAME:-latex-environment}"
REPOSITORY_OWNER="${ALDC_REPOSITORY_OWNER:-smkwlab}"
# REPOSITORY_OWNER goes into the download URL; REPOSITORY_NAME is additionally
# used as the extracted directory in `cd` / `rm -rf` below. Validate both:
# the GitHub login / repository character set, no leading dash (a leading `-`
# would be parsed as an option by cd/rm even when quoted), and — for the name —
# no dot-only / `..` traversal value.
case "$REPOSITORY_OWNER" in
''|-*|*[!A-Za-z0-9-]*)

@github-actions github-actions Bot Jul 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ℹ️ [LOW] [LOW] REPOSITORY_OWNER のパターンに *- （末尾ダッシュ）の拒否が含まれていない

GitHub のユーザー名・Organization 名は末尾にハイフンを置けない仕様です（[A-Za-z0-9](-?[A-Za-z0-9])* 相当）。現在のパターン ''|-*|*[!A-Za-z0-9-]*) では foo- や foo--bar も通過します。

セキュリティ上の直接的なリスクは低いですが、誤設定を早期に検出するという観点では、末尾ダッシュや連続ダッシュも拒否するとより堅牢になります。

case "$REPOSITORY_OWNER" in
    ''|-*|*-|*--*|*[!A-Za-z0-9-]*)

@github-actions github-actions Bot Jul 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ [MEDIUM] REPOSITORY_OWNER の検証パターン *[!A-Za-z0-9-]* はアンダースコア _ を許可していません。GitHub の Organization 名や User 名にはアンダースコアが使用可能です（例: my_org）。意図的な制限であればコメントに明記すべきですが、もし GitHub の実際の命名規則に合わせるなら *[!A-Za-z0-9_-]* とすべきです。

@toshi0806 toshi0806 Jul 10, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

こちらは誤検知と考えます。GitHub のユーザー名・組織名は「英数字と単一ハイフンのみ」で、アンダースコア _ は使用できません（例 my_org は無効。ハイフンも先頭・末尾・連続は不可）。したがって owner を [A-Za-z0-9-] に制限するのは GitHub の実際の命名規則に沿った正しい制限です。コード変更は不要と判断します。

echo "Error: invalid ALDC_REPOSITORY_OWNER: ${REPOSITORY_OWNER}" >&2
exit 1
;;
esac
Comment thread
Copilot marked this conversation as resolved.
case "$REPOSITORY_NAME" in
''|.|..|-*|*[!A-Za-z0-9._-]*)

@github-actions github-actions Bot Jul 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ [MEDIUM] REPOSITORY_NAME の検証パターン *[!A-Za-z0-9._-]* は、ドットを含む名前（例: my.repo）を許可しますが、.. のみを個別に弾いているだけで、... や .hidden のような名前は通過します。

より重要な問題として、cd や rm -rf で使われるのは ${REPOSITORY_NAME}-${BRANCH} という形式（ZIP展開後のディレクトリ名）であり、REPOSITORY_NAME 単体ではありません。GitHub の ZIP アーカイブは {repo}-{branch}/ という形式で展開されるため、実際に使われるパスは ${REPOSITORY_NAME}-${BRANCH} です。スクリプト内でこのディレクトリ名を変数として定義し、それを検証・使用する方が安全で明確です。

EXTRACTED_DIR="${REPOSITORY_NAME}-${BRANCH}"
# cd "${EXTRACTED_DIR}" / rm -rf "${EXTRACTED_DIR}" として使用

@toshi0806 toshi0806 Jul 10, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

実害はないと考えます。展開ディレクトリは常に ${REPOSITORY_NAME}-${BRANCH}（= ...-release 等）と suffix されるため、cd/rm に渡る値が exact ./.. になることはなく path traversal は発生しません。また ...・.hidden のようなドット始まり/ドットのみ相当の名前は GitHub のリポジトリ名として無効で、ダウンロード URL が 404 になります。現行の検証（文字種＋先頭ハイフン＋ exact ./.. 拒否）は proportionate と判断し、現状維持とします。

echo "Error: invalid ALDC_REPOSITORY_NAME: ${REPOSITORY_NAME}" >&2
exit 1
;;
esac
Comment thread
Copilot marked this conversation as resolved.
REPOSITORY_URL="https://github.com/${REPOSITORY_OWNER}/${REPOSITORY_NAME}"
BRANCH='release'
ZIP_NAME="${REPOSITORY_NAME}-${BRANCH}.zip"
Expand Down Expand Up @@ -41,7 +60,9 @@ while [ $# -gt 0 ]; do
echo " --help, -h Show this help message"
echo ""
echo "Environment Variables:"
echo " ALDC_QUIET=1 Enable quiet mode"
echo " ALDC_QUIET=1 Enable quiet mode"
echo " ALDC_REPOSITORY_OWNER Source org/user (default: smkwlab)"

@github-actions github-actions Bot Jul 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ℹ️ [LOW] ヘルプメッセージの列幅が揃っていません。ALDC_REPOSITORY_OWNER と ALDC_REPOSITORY_NAME の説明列の開始位置が ALDC_QUIET=1 と異なります（ALDC_REPOSITORY_OWNER は末尾スペースが1つ少ない）。

  ALDC_QUIET=1              Enable quiet mode
  ALDC_REPOSITORY_OWNER    Source org/user (default: smkwlab)
  ALDC_REPOSITORY_NAME     Source repo (default: latex-environment)

ALDC_REPOSITORY_OWNER の後のスペースが4つ、ALDC_REPOSITORY_NAME の後のスペースが5つになっており、揃っていません。統一することを推奨します。

@toshi0806 toshi0806 Jul 10, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

acf0495 で help の列を揃えました（説明列の開始位置を統一）。

echo " ALDC_REPOSITORY_NAME Source repo (default: latex-environment)"
exit 0
;;
*)
Expand Down
22 changes: 19 additions & 3 deletions docs/CLAUDE-DEVELOPMENT.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,10 +10,24 @@ This document covers the development workflow, architecture, and technical detai
- **Git Integration**: Automatic repository initialization and commit handling

### Environment Source
- **Source Repository**: smkwlab/latex-environment
- **Source Repository**: smkwlab/latex-environment (default)
- **Branch**: release (stable releases)
- **Installation Method**: Downloads ZIP, extracts, and integrates files

The source is overridable for other-org deployments (defaults preserve
smkwlab behavior):

| Variable | Default | Purpose |
|----------|---------|---------|
| `ALDC_REPOSITORY_OWNER` | `smkwlab` | Org/user hosting the latex-environment fork. |
| `ALDC_REPOSITORY_NAME` | `latex-environment` | Repository name to download. |

`ALDC_REPOSITORY_OWNER` is used only in the download URL; `ALDC_REPOSITORY_NAME`
is additionally used as the extracted directory in `cd` / `rm -rf`. Both are
validated (GitHub character set, no leading dash, and — for the name — no `.`
or `..` traversal) before use. The release branch name is fixed to `release`
by convention.
Comment on lines +17 to +29

@toshi0806 toshi0806 Jul 10, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

06751a1 で対応しました。Security Considerations の「Downloads from official smkwlab repository only」を、既定は smkwlab/latex-environment だが ALDC_REPOSITORY_OWNER/NAME で override 可能（文字検証あり）である旨に更新しました。実装との不整合を解消しています。


## Installation Process

### Process Flow
Expand Down Expand Up @@ -65,7 +79,7 @@ texlive-ja-textlint (Docker base image)
## Configuration Details

### Default Settings
- **Repository**: smkwlab/latex-environment
- **Repository**: smkwlab/latex-environment (override with `ALDC_REPOSITORY_OWNER` / `ALDC_REPOSITORY_NAME`)
- **Branch**: release (for stability)
- **Installation Location**: Current working directory
- **Backup Strategy**: Conflicts renamed with `-aldc` suffix
Expand Down Expand Up @@ -99,7 +113,9 @@ texlive-ja-textlint (Docker base image)

## Security Considerations

- Downloads from official smkwlab repository only
- Downloads from smkwlab/latex-environment by default; the source is
overridable via `ALDC_REPOSITORY_OWNER`/`ALDC_REPOSITORY_NAME`, which are
character-validated (no path separators, leading dash, or `.`/`..`)
- Uses HTTPS for all network communications
- No external dependencies beyond standard unix tools
- Repository verification through GitHub's infrastructure
Expand Down
Loading