noz-cli/NozCli/Commands/NewCommand.cs
kryptomrx b971d45e78 security: slug validation, path traversal protection, temp file cleanup
- SlugGuard.IsValid() rejects slugs with path traversal (../, //, uppercase)
- SlugGuard.ToSafePath() ensures sync writes stay within target directory
- PushCommand: skip files with invalid slugs before upload
- SyncCommand: validate server-returned slugs before writing to disk
- EditCommand/NewCommand: try/finally guarantees temp file deletion on crash
- NotesCache: set 600 permissions on cache file (metadata only, no token)
- NewCommand: remove dead Sha256 method (HashHelper already covers this)
2026-05-16 23:36:40 +02:00

93 lines
2.9 KiB
C#

using System.Diagnostics;
using NozCli.Core.Models;
using NozCli.Repl;
using Spectre.Console;
namespace NozCli.Commands;
public class NewCommand : ICommand
{
public string Name => "new";
public string Description => "Create a new note and open it in nano (or -c for VS Code)";
public string Usage => "new [-c] <slug-or-name>";
public async Task ExecuteAsync(string[] args, ReplContext ctx, CancellationToken ct = default)
{
var useCode = args.Contains("-c") || args.Contains("--code");
var nameArg = args.FirstOrDefault(a => !a.StartsWith('-'));
if (nameArg is null) { AnsiConsole.MarkupLine("[red]Usage: new [-c] <slug-or-name>[/]"); return; }
var slug = ctx.ResolveNewSlug(nameArg);
if (ctx.NoteCache.Any(n => n.Slug == slug))
{
AnsiConsole.MarkupLine($"[yellow]Note already exists:[/] {slug} [dim](use 'edit' to modify it)[/]");
return;
}
var topic = ctx.CurrentTopic ?? (slug.Contains('/') ? slug.Split('/')[0] : slug);
var title = ToTitle(slug.Split('/').Last());
var lang = "de";
var template = $"""
---
title: "{title}"
description: ""
topic: {topic}
status: seed
lang: {lang}
---
# {title}
""";
var tmp = Path.Combine(Path.GetTempPath(), $"noz-new-{slug.Replace('/', '-')}.md");
await File.WriteAllTextAsync(tmp, template);
string markdown;
try
{
var (editor, editorArgs) = useCode
? EditCommand.ResolveCode(tmp, ctx.Config.CodeEditor)
: EditCommand.ResolveTerminal(tmp, ctx.Config.Editor);
AnsiConsole.MarkupLine($"[dim]Opening {editor} …[/]");
var proc = Process.Start(new ProcessStartInfo
{
FileName = editor,
Arguments = editorArgs,
UseShellExecute = false,
});
proc?.WaitForExit();
markdown = await File.ReadAllTextAsync(tmp);
}
finally
{
if (File.Exists(tmp)) File.Delete(tmp);
}
if (markdown.Trim() == template.Trim())
{
AnsiConsole.MarkupLine("[dim]No changes — note not created.[/]");
return;
}
var push = AnsiConsole.Confirm($"Push [cyan]{slug}[/] to server?");
if (!push) { AnsiConsole.MarkupLine("[dim]Discarded.[/]"); return; }
await AnsiConsole.Status().StartAsync("Creating…", async _ =>
{
await ctx.Api.PutNoteAsync(slug, markdown, ct);
ctx.NoteCache = await ctx.Api.GetNotesAsync(ct);
});
AnsiConsole.MarkupLine($"[green]✓[/] {slug} created");
}
private static string ToTitle(string slug) =>
string.Join(' ', slug.Split('-').Select(w =>
w.Length > 0 ? char.ToUpper(w[0]) + w[1..] : w));
}