fix(create-astro): validate integration names to prevent shell injection

.changeset/fix-add-shell-injection.md

@@ -0,0 +1,5 @@
+---
+'create-astro': patch
+---
+
+Fixes shell command injection via `--add` flag by validating integration names against npm package name pattern before passing to shell

packages/create-astro/src/actions/dependencies.ts

@@ -5,6 +5,15 @@ import { error, info, title } from '../messages.js';
 import { shell } from '../shell.js';
 import type { Context } from './context.js';
 
+// Valid npm package name pattern: lowercase letters, numbers, hyphens, underscores, dots
+// Scoped packages start with @scope/
+// This prevents shell metacharacters from being passed to the shell
+const VALID_INTEGRATION_NAME = /^(@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/;
+
+function isValidIntegrationName(name: string): boolean {
+	return VALID_INTEGRATION_NAME.test(name);
+}
+
 export async function dependencies(
 	ctx: Pick<
 		Context,
@@ -26,6 +35,18 @@ export async function dependencies(
 
 	ctx.add = ctx.add?.reduce<string[]>((acc, item) => acc.concat(item.split(',')), []);
 
+	// Validate integration names to prevent shell injection
+	if (ctx.add) {
+		const invalidNames = ctx.add.filter((name) => !isValidIntegrationName(name));
+		if (invalidNames.length > 0) {
+			await error(
+				'error',
+				`Invalid integration name(s): ${invalidNames.join(', ')}. Integration names must be valid npm package names.`,
+			);
+			ctx.add = ctx.add.filter((name) => isValidIntegrationName(name));
+		}
+	}
+
 	if (ctx.dryRun) {
 		await info(
 			'--dry-run',

packages/create-astro/test/dependencies.test.js

@@ -6,6 +6,54 @@ import { setup } from './utils.js';
 describe('dependencies', () => {
 	const fixture = setup();
 
+	it('rejects integration names with shell metacharacters', async () => {
+		const context = {
+			cwd: '',
+			yes: true,
+			packageManager: 'npm',
+			dryRun: true,
+			prompt: () => ({ deps: true }),
+			add: ['react; open -a Calculator.app;'],
+		};
+
+		await dependencies(context);
+
+		assert.ok(fixture.hasMessage('Invalid integration name(s)'));
+		assert.deepEqual(context.add, []);
+	});
+
+	it('accepts valid integration names', async () => {
+		const context = {
+			cwd: '',
+			yes: true,
+			packageManager: 'npm',
+			dryRun: true,
+			prompt: () => ({ deps: true }),
+			add: ['react', '@astrojs/tailwind', 'vue'],
+		};
+
+		await dependencies(context);
+
+		assert.ok(!fixture.hasMessage('Invalid integration name(s)'));
+		assert.deepEqual(context.add, ['react', '@astrojs/tailwind', 'vue']);
+	});
+
+	it('filters out only invalid integration names', async () => {
+		const context = {
+			cwd: '',
+			yes: true,
+			packageManager: 'npm',
+			dryRun: true,
+			prompt: () => ({ deps: true }),
+			add: ['react', 'vue; rm -rf /', 'svelte'],
+		};
+
+		await dependencies(context);
+
+		assert.ok(fixture.hasMessage('Invalid integration name(s)'));
+		assert.deepEqual(context.add, ['react', 'svelte']);
+	});
+
 	it('--yes', async () => {
 		const context = {
 			cwd: '',