luna/marketingskills
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix: add input validation and safe JSON parsing across 13 CLIs

Browse Source 
Add missing parameter validation to prevent /path/undefined API calls:
- dub: require --url for links create
- google-search-console: require --sitemap-url for sitemaps submit
- kit: validate IDs and emails for subscribers, forms, sequences, tags, broadcasts
- mailchimp: validate IDs for lists get, campaigns get/create/send, members add, reports get
- resend: validate --from/--to/--subject for send, audience/contact IDs for contacts
- rewardful: validate IDs for affiliates get/update, commissions get, links create
- semrush: require --domain/--phrase for all domain and keyword commands
- sendgrid: validate --from/--to/--subject for send, campaign IDs, email for validate

Wrap bare JSON.parse() calls in try/catch for user-provided JSON:
- dub (--links), ga4 (--params), kit (--fields x4), mixpanel (--properties x2),
  onesignal (--filters), paddle (--scheduled-change, --items x2),
  resend (--emails, --variables x2), segment (--properties, --traits, --events),
  sendgrid (--template-data)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Corey Haines
2026-02-17 22:44:06 -08:00
parent 51bdf2f6b3
commit 8eaff5e29f
13 changed files with 103 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/clis/resend.js
+17 -3
View File
@@ -56,6 +56,7 @@ async function main() {
switch (cmd) {
case 'send': {
if (!args.from || !args.to || !args.subject) { result = { error: '--from, --to, and --subject required' }; break }
const body = { from: args.from, to: args.to?.split(','), subject: args.subject }
if (args.html) body.html = args.html
if (args.text) body.text = args.text
@@ -156,6 +157,7 @@ async function main() {
case 'contacts': {
const audienceId = sub
if (!audienceId) { result = { error: 'Audience ID required as subcommand arg' }; break }
const action = rest[0]
const contactId = rest[1]
switch (action) {
@@ -166,6 +168,7 @@ async function main() {
break
}
case 'get':
if (!rest[1]) { result = { error: 'Contact ID required' }; break }
result = await api('GET', `/audiences/${audienceId}/contacts/${contactId}`)
break
case 'create': {
@@ -177,6 +180,7 @@ async function main() {
break
}
case 'update': {
if (!rest[1]) { result = { error: 'Contact ID required' }; break }
const body = {}
if (args['first-name']) body.first_name = args['first-name']
if (args['last-name']) body.last_name = args['last-name']
@@ -185,6 +189,7 @@ async function main() {
break
}
case 'delete':
if (!rest[1]) { result = { error: 'Contact ID required' }; break }
result = await api('DELETE', `/audiences/${audienceId}/contacts/${contactId}`)
break
default:
@@ -216,7 +221,12 @@ async function main() {
break
case 'batch': {
const emails = JSON.parse(args.emails || '[]')
let emails
try {
emails = JSON.parse(args.emails || '[]')
} catch (e) {
result = { error: 'Invalid JSON for --emails: ' + e.message }; break
}
result = await api('POST', '/emails/batch', emails)
break
}
@@ -241,7 +251,9 @@ async function main() {
if (args.subject) body.subject = args.subject
if (args['reply-to']) body.reply_to = args['reply-to']
if (args.text) body.text = args.text
if (args.variables) body.variables = JSON.parse(args.variables)
if (args.variables) {
try { body.variables = JSON.parse(args.variables) } catch (e) { result = { error: 'Invalid JSON for --variables: ' + e.message }; break }
}
result = await api('POST', '/templates', body)
break
}
@@ -254,7 +266,9 @@ async function main() {
if (args.subject) body.subject = args.subject
if (args['reply-to']) body.reply_to = args['reply-to']
if (args.text) body.text = args.text
if (args.variables) body.variables = JSON.parse(args.variables)
if (args.variables) {
try { body.variables = JSON.parse(args.variables) } catch (e) { result = { error: 'Invalid JSON for --variables: ' + e.message }; break }
}
result = await api('PATCH', `/templates/${rest[0]}`, body)
break
}