luna/marketingskills
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix: add input validation and safe JSON parsing across 13 CLIs

Browse Source 
Add missing parameter validation to prevent /path/undefined API calls:
- dub: require --url for links create
- google-search-console: require --sitemap-url for sitemaps submit
- kit: validate IDs and emails for subscribers, forms, sequences, tags, broadcasts
- mailchimp: validate IDs for lists get, campaigns get/create/send, members add, reports get
- resend: validate --from/--to/--subject for send, audience/contact IDs for contacts
- rewardful: validate IDs for affiliates get/update, commissions get, links create
- semrush: require --domain/--phrase for all domain and keyword commands
- sendgrid: validate --from/--to/--subject for send, campaign IDs, email for validate

Wrap bare JSON.parse() calls in try/catch for user-provided JSON:
- dub (--links), ga4 (--params), kit (--fields x4), mixpanel (--properties x2),
  onesignal (--filters), paddle (--scheduled-change, --items x2),
  resend (--emails, --variables x2), segment (--properties, --traits, --events),
  sendgrid (--template-data)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Corey Haines
2026-02-17 22:44:06 -08:00
parent 51bdf2f6b3
commit 8eaff5e29f
13 changed files with 103 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/clis/segment.js
+11 -4
View File
@@ -93,7 +93,9 @@ async function main() {
userId: args['user-id'],
event: args.event,
}
if (args.properties) body.properties = JSON.parse(args.properties)
if (args.properties) {
try { body.properties = JSON.parse(args.properties) } catch { result = { error: 'Invalid JSON in --properties' }; break }
}
result = await trackApi('POST', '/track', body)
break
}
@@ -107,7 +109,9 @@ async function main() {
case 'user': {
if (!args['user-id']) { result = { error: '--user-id required' }; break }
const body = { userId: args['user-id'] }
if (args.traits) body.traits = JSON.parse(args.traits)
if (args.traits) {
try { body.traits = JSON.parse(args.traits) } catch { result = { error: 'Invalid JSON in --traits' }; break }
}
result = await trackApi('POST', '/identify', body)
break
}
@@ -122,7 +126,9 @@ async function main() {
if (!args['user-id']) { result = { error: '--user-id required' }; break }
const body = { userId: args['user-id'] }
if (args.name) body.name = args.name
if (args.properties) body.properties = JSON.parse(args.properties)
if (args.properties) {
try { body.properties = JSON.parse(args.properties) } catch { result = { error: 'Invalid JSON in --properties' }; break }
}
result = await trackApi('POST', '/page', body)
break
}
@@ -135,7 +141,8 @@ async function main() {
switch (sub) {
case 'send': {
if (!args.events) { result = { error: '--events required (JSON array)' }; break }
const batch = JSON.parse(args.events)
let batch
try { batch = JSON.parse(args.events) } catch { result = { error: 'Invalid JSON in --events' }; break }
result = await trackApi('POST', '/batch', { batch })
break
}