Installation Docs#572
Conversation
Signed-off-by: Stephen Rugh <rugh@adobe.com>
Co-authored-by: Carlos A. Cabrera <316104+fnhipster@users.noreply.github.com>
…ing or encoding Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Pr/installation code only
Add relevant AEM Commerce link
…stom intros - Add version accuracy tracking to ensure docs match actual code - Implement three-layer safety net (console, version display, warning box) - Extract customizable models from ConfigProps.models definition - Handle import aliases in model extraction (e.g., Cart as CartModel) - Implement drop-in specific introductory paragraphs - Add missing initialization sidebar links - Include enrichment files with custom model descriptions
- Automatically detect and checkout the latest boilerplate release tag - Read drop-in versions from that specific release instead of main branch - Ensures documentation matches published boilerplate versions - Falls back to main branch if tags cannot be determined - Returns boilerplate tag info for logging and verification
…tation fix: restore hotfix documentation accidentally deleted in PR #556
…nfrastructure Fix initialization documentation generator
New Initialization files
Signed-off-by: Stephen Rugh <rugh@adobe.com>
add description of what the productHeader actually does
Add pointers to ACCS/branding
Set trailingSlash to always
bdenham
added
javascript
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
|
||
| if (!existsSync(boilerplatePath)) { | ||
| console.log(' Cloning boilerplate repository...'); | ||
| execSync('git clone --depth 1 https://github.com/hlxsites/aem-boilerplate-commerce.git ' + boilerplatePath, { stdio: 'inherit' }); |
Check warning
Code scanning / CodeQL
Shell command built from environment values Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 7 months ago
To fix the problem, replace the use of direct shell command string concatenation with a safer approach: use execFileSync (or execSync with argument arrays and {shell: false}) so that all arguments are passed as separate parameters, avoiding shell interpretation. For the git clone command, this means:
- Changing the
"git clone --depth 1 https://github.com/hlxsites/aem-boilerplate-commerce.git " + boilerplatePathstring to an invocation with the argument array["clone", "--depth", "1", "https://github.com/hlxsites/aem-boilerplate-commerce.git", boilerplatePath]. - Replace
execSync(...)withexecFileSync("git", [...], { stdio: 'inherit' }). - Import
execFileSyncfrom'child_process'.
These changes should be made only to the relevant line(s) in scripts/@generate-boilerplate-docs.js, and only the git clone invocation (not the later cd ... && git pull, which may require a followup but is not flagged in this alert).
| @@ -21,7 +21,7 @@ | ||
|
|
||
| import { readFileSync, writeFileSync, existsSync, mkdirSync, readdirSync, statSync } from 'fs'; | ||
| import { join, dirname, basename } from 'path'; | ||
| import { execSync } from 'child_process'; | ||
| import { execSync, execFileSync } from 'child_process'; | ||
|
|
||
| // Import shared utilities | ||
| import { getProjectRoot } from './lib/generator-core.js'; | ||
| @@ -44,7 +44,12 @@ | ||
|
|
||
| if (!existsSync(boilerplatePath)) { | ||
| console.log(' Cloning boilerplate repository...'); | ||
| execSync('git clone --depth 1 https://github.com/hlxsites/aem-boilerplate-commerce.git ' + boilerplatePath, { stdio: 'inherit' }); | ||
| execFileSync('git', [ | ||
| 'clone', | ||
| '--depth', '1', | ||
| 'https://github.com/hlxsites/aem-boilerplate-commerce.git', | ||
| boilerplatePath | ||
| ], { stdio: 'inherit' }); | ||
| } else { | ||
| console.log(' Updating boilerplate repository...'); | ||
| execSync(`cd ${boilerplatePath} && git pull`, { stdio: 'inherit' }); |
| execSync('git clone --depth 1 https://github.com/hlxsites/aem-boilerplate-commerce.git ' + boilerplatePath, { stdio: 'inherit' }); | ||
| } else { | ||
| console.log(' Updating boilerplate repository...'); | ||
| execSync(`cd ${boilerplatePath} && git pull`, { stdio: 'inherit' }); |
Check warning
Code scanning / CodeQL
Shell command built from environment values Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 7 months ago
The best fix is to avoid building the shell command as a string and passing it to execSync, and instead use a safer alternative that allows specifying the working directory and command arguments separately — eliminating interpretation ambiguities. For git pull in a directory, use execFileSync("git", ["pull"], { cwd: boilerplatePath, stdio: 'inherit' }). This runs git pull with the working directory set to boilerplatePath, avoiding the unsafe shell string concatenation and removing the risk of command injection or accidents due to shell interpretation of special characters. The code to update is line 50 in scripts/@generate-boilerplate-docs.js: replace the execSync using string interpolation with execFileSync. Also, execFileSync should be imported from 'child_process', so edit the import statement on line 24 to also import execFileSync. No other files or regions require changes.
| @@ -21,7 +21,7 @@ | ||
|
|
||
| import { readFileSync, writeFileSync, existsSync, mkdirSync, readdirSync, statSync } from 'fs'; | ||
| import { join, dirname, basename } from 'path'; | ||
| import { execSync } from 'child_process'; | ||
| import { execSync, execFileSync } from 'child_process'; | ||
|
|
||
| // Import shared utilities | ||
| import { getProjectRoot } from './lib/generator-core.js'; | ||
| @@ -47,7 +47,7 @@ | ||
| execSync('git clone --depth 1 https://github.com/hlxsites/aem-boilerplate-commerce.git ' + boilerplatePath, { stdio: 'inherit' }); | ||
| } else { | ||
| console.log(' Updating boilerplate repository...'); | ||
| execSync(`cd ${boilerplatePath} && git pull`, { stdio: 'inherit' }); | ||
| execFileSync('git', ['pull'], { cwd: boilerplatePath, stdio: 'inherit' }); | ||
| } | ||
|
|
||
| return boilerplatePath; |
| execFileSync('git', ['clone', '--depth', '1', 'https://github.com/hlxsites/aem-boilerplate-commerce.git', boilerplatePath], { stdio: 'inherit' }); | ||
| } else { | ||
| console.log(' Updating boilerplate repository...'); | ||
| execSync(`cd ${boilerplatePath} && git pull`, { stdio: 'inherit' }); |
Check warning
Code scanning / CodeQL
Shell command built from environment values Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 7 months ago
To fix this, avoid interpolating shell-sensitive values (boilerplatePath) directly into the shell command string passed to execSync. Instead, you should use execFileSync for calling Git, with args array, or pass the working directory via cwd option to avoid string interpolation entirely. In this specific case, to run git pull inside the repository directory:
- Change the
execSync(cd ${boilerplatePath} && git pull, ...)call toexecFileSync('git', ['pull'], { cwd: boilerplatePath, stdio: 'inherit' }). - This accurately runs
git pullin the desired directory, without invoking a shell or interpreting the path. - Only change the call on line 48 in
scripts/@generate-merchant-block-docs.js. - Require
execFileSyncfromchild_process, if not already imported (the file currently only importsexecSync). Replace or augment the import at the top as appropriate.
| @@ -20,7 +20,7 @@ | ||
|
|
||
| import { readFileSync, writeFileSync, existsSync, readdirSync, statSync } from 'fs'; | ||
| import { join } from 'path'; | ||
| import { execSync } from 'child_process'; | ||
| import { execSync, execFileSync } from 'child_process'; | ||
|
|
||
| // Import shared utilities | ||
| import { getProjectRoot } from './lib/generator-core.js'; | ||
| @@ -45,7 +45,7 @@ | ||
| execFileSync('git', ['clone', '--depth', '1', 'https://github.com/hlxsites/aem-boilerplate-commerce.git', boilerplatePath], { stdio: 'inherit' }); | ||
| } else { | ||
| console.log(' Updating boilerplate repository...'); | ||
| execSync(`cd ${boilerplatePath} && git pull`, { stdio: 'inherit' }); | ||
| execFileSync('git', ['pull'], { cwd: boilerplatePath, stdio: 'inherit' }); | ||
| } | ||
|
|
||
| return boilerplatePath; |
6 participants
Purpose of this pull request
This pull request (PR) ...
Associated JIRA ticket
Staging preview
Affected pages
Links to source code