luna/marketingskills
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix: add input validation and safe JSON parsing across 13 CLIs

Browse Source 
Add missing parameter validation to prevent /path/undefined API calls:
- dub: require --url for links create
- google-search-console: require --sitemap-url for sitemaps submit
- kit: validate IDs and emails for subscribers, forms, sequences, tags, broadcasts
- mailchimp: validate IDs for lists get, campaigns get/create/send, members add, reports get
- resend: validate --from/--to/--subject for send, audience/contact IDs for contacts
- rewardful: validate IDs for affiliates get/update, commissions get, links create
- semrush: require --domain/--phrase for all domain and keyword commands
- sendgrid: validate --from/--to/--subject for send, campaign IDs, email for validate

Wrap bare JSON.parse() calls in try/catch for user-provided JSON:
- dub (--links), ga4 (--params), kit (--fields x4), mixpanel (--properties x2),
  onesignal (--filters), paddle (--scheduled-change, --items x2),
  resend (--emails, --variables x2), segment (--properties, --traits, --events),
  sendgrid (--template-data)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Corey Haines
2026-02-17 22:44:06 -08:00
parent 51bdf2f6b3
commit 8eaff5e29f
13 changed files with 103 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/clis/kit.js
+23 -4
View File
@@ -91,12 +91,16 @@ async function main() {
break
}
case 'get':
if (!rest[0]) { result = { error: 'Subscriber ID required' }; break }
result = await api('GET', `/subscribers/${rest[0]}`)
break
case 'update': {
if (!rest[0]) { result = { error: 'Subscriber ID required' }; break }
const body = {}
if (args['first-name']) body.first_name = args['first-name']
if (args.fields) body.fields = JSON.parse(args.fields)
if (args.fields) {
try { body.fields = JSON.parse(args.fields) } catch { result = { error: 'Invalid JSON in --fields' }; break }
}
result = await api('PUT', `/subscribers/${rest[0]}`, body)
break
}
@@ -116,10 +120,14 @@ async function main() {
result = await api('GET', '/forms', null, false)
break
case 'subscribe': {
if (!rest[0]) { result = { error: 'Form ID required' }; break }
if (!args.email) { result = { error: '--email required' }; break }
const formId = rest[0]
const body = { email: args.email }
if (args['first-name']) body.first_name = args['first-name']
if (args.fields) body.fields = JSON.parse(args.fields)
if (args.fields) {
try { body.fields = JSON.parse(args.fields) } catch { result = { error: 'Invalid JSON in --fields' }; break }
}
result = await api('POST', `/forms/${formId}/subscribe`, body, false)
break
}
@@ -134,10 +142,14 @@ async function main() {
result = await api('GET', '/sequences', null, false)
break
case 'subscribe': {
if (!rest[0]) { result = { error: 'Sequence ID required' }; break }
if (!args.email) { result = { error: '--email required' }; break }
const sequenceId = rest[0]
const body = { email: args.email }
if (args['first-name']) body.first_name = args['first-name']
if (args.fields) body.fields = JSON.parse(args.fields)
if (args.fields) {
try { body.fields = JSON.parse(args.fields) } catch { result = { error: 'Invalid JSON in --fields' }; break }
}
result = await api('POST', `/sequences/${sequenceId}/subscribe`, body, false)
break
}
@@ -152,16 +164,22 @@ async function main() {
result = await api('GET', '/tags', null, false)
break
case 'subscribe': {
if (!rest[0]) { result = { error: 'Tag ID required' }; break }
if (!args.email) { result = { error: '--email required' }; break }
const tagId = rest[0]
const body = { email: args.email }
if (args['first-name']) body.first_name = args['first-name']
if (args.fields) body.fields = JSON.parse(args.fields)
if (args.fields) {
try { body.fields = JSON.parse(args.fields) } catch { result = { error: 'Invalid JSON in --fields' }; break }
}
result = await api('POST', `/tags/${tagId}/subscribe`, body, false)
break
}
case 'remove': {
if (!rest[0]) { result = { error: 'Tag ID required' }; break }
const tagId = rest[0]
const subscriberId = rest[1] || args['subscriber-id']
if (!subscriberId) { result = { error: 'Subscriber ID required' }; break }
result = await api('DELETE', `/subscribers/${subscriberId}/tags/${tagId}`)
break
}
@@ -178,6 +196,7 @@ async function main() {
break
}
case 'create': {
if (!args.subject || !args.content) { result = { error: '--subject and --content required' }; break }
const body = {
subject: args.subject,
content: args.content,