{"record":{"id":"3964bc64f2597438","repo":"abpframework/abp","slug":"invalid-npm-package-version-detected-sanitizefor","errorCode":null,"errorMessage":"Invalid npm package version detected: {SanitizeForLog(version)}","messagePattern":"Invalid npm package version detected: (.+?)","errorType":"exception","errorClass":"CliUsageException","httpStatus":null,"severity":"error","filePath":"framework/src/Volo.Abp.Cli.Core/Volo/Abp/Cli/Utils/NpmHelper.cs","lineNumber":103,"sourceCode":"        RegexOptions.Compiled);\n\n    private static readonly Regex SafeVersionRegex = new(\n        @\"^[a-zA-Z0-9._~^+\\-]+$\",\n        RegexOptions.Compiled);\n\n    public static void EnsureSafePackageName(string packageName)\n    {\n        if (string.IsNullOrWhiteSpace(packageName) || !SafePackageNameRegex.IsMatch(packageName))\n        {\n            throw new CliUsageException($\"Invalid npm package name detected: {SanitizeForLog(packageName)}\");\n        }\n    }\n\n    public static void EnsureSafeVersion(string version)\n    {\n        if (!string.IsNullOrWhiteSpace(version) && !SafeVersionRegex.IsMatch(version))\n        {\n            throw new CliUsageException($\"Invalid npm package version detected: {SanitizeForLog(version)}\");\n        }\n    }\n\n    public static string SanitizeForLog(string value)\n    {\n        if (value == null)\n        {\n            return \"(null)\";\n        }\n\n        return Regex.Replace(value, @\"[\\x00-\\x1F\\x7F]\", \"?\");\n    }\n\n    public string GetInstalledNpmPackages()\n    {\n        Logger.LogInformation(\"Checking installed npm global packages...\");\n        return CmdHelper.RunCmdAndGetOutput(\"npm list -g --depth 0 --silent\", out int exitCode);\n    }","sourceCodeStart":85,"sourceCodeEnd":121,"githubUrl":"https://github.com/abpframework/abp/blob/7ed43b1931b9df46a50c0c59148a18645641d0df/framework/src/Volo.Abp.Cli.Core/Volo/Abp/Cli/Utils/NpmHelper.cs#L85-L121","documentation":"Thrown by NpmHelper.EnsureSafeVersion, the version counterpart to the package-name guard. SafeVersionRegex allows only [A-zA-Z0-9._~^+-], which covers semver, caret/tilde ranges, and pre-release tags. A null/whitespace version is allowed (optional), but any other character (spaces, comparison operators, shell metacharacters) throws a CliUsageException before the value is concatenated into the shell command.","triggerScenarios":"Calling NpmInstallPackage / YarnAddPackage with a version string containing spaces, comparison operators (>=, <), or shell metacharacters; or a version pulled from untrusted input.","commonSituations":"Passing a full npm version range with spaces like \">= 1.0.0 < 2.0.0\"; templating a version from a config file that includes surrounding quotes or whitespace; copy-pasting a version specifier with a leading 'v'.","solutions":["Pass a plain semver value or a caret/tilde range with no spaces, e.g. \"1.2.3\", \"^1.0.0\", \"~2.1.0\", \"1.0.0-beta.1\".","Omit the version (pass null/empty) to install the latest.","Trim and validate the version source before passing it; reject anything with spaces or shell metacharacters upstream."],"exampleFix":"// before\nhelper.YarnAddPackage(\"lodash\", \">= 4.0.0 < 5\", dir);\n\n// after — use caret/tilde range without spaces\nhelper.YarnAddPackage(\"lodash\", \"^4.17.0\", dir);","handlingStrategy":"validation","validationCode":"using System.Text.RegularExpressions;\nprivate static readonly Regex SafeVer = new(@\"^[a-zA-Z0-9._~^+\\-]+$\", RegexOptions.Compiled);\nstatic string EnsureVer(string? version) =>\n    string.IsNullOrWhiteSpace(version) ? version! :\n    !SafeVer.IsMatch(version) ? throw new ArgumentException(\"Invalid npm version\") : version;","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Pass only plain semver or caret/tilde ranges with no spaces.","Trim version strings from config before use.","Omit version when latest is acceptable."],"tags":["npm","command-injection","validation","abp-cli","security"],"backgroundTag":null,"analyzedSha":"7ed43b1931b9df46a50c0c59148a18645641d0df","analyzedAt":"2026-08-13T16:26:11.351Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}