Reject line terminators in info.securityContact and info.license (#818)

Co-authored-by: Claude <noreply@anthropic.com>

Author: ericglau

.changeset/quick-spiders-cheer.md

@@ -0,0 +1,8 @@
+---
+'@openzeppelin/wizard': patch
+'@openzeppelin/wizard-cairo': patch
+'@openzeppelin/wizard-stellar': patch
+'@openzeppelin/wizard-stylus': patch
+---
+
+Reject line terminators in `info.securityContact` and `info.license` to prevent breaking out of the generated comment lines. Fixes [GHSA-9wxg-vf3r-56hc](https://github.com/OpenZeppelin/contracts-wizard/security/advisories/GHSA-9wxg-vf3r-56hc).

packages/core/cairo/src/set-info.test.ts

@@ -0,0 +1,33 @@
+import test from 'ava';
+
+import { ContractBuilder } from './contract';
+import { defaults as macrosDefaults } from './set-macros';
+import { setInfo } from './set-info';
+import type { OptionsError } from './error';
+
+const lineBreaks: [string, string][] = [
+  ['LF', '\n'],
+  ['CR', '\r'],
+  ['CRLF', '\r\n'],
+  ['LS', '\u2028'],
+  ['PS', '\u2029'],
+];
+
+for (const [name, ch] of lineBreaks) {
+  test(`setInfo rejects ${name} in securityContact`, t => {
+    const c = new ContractBuilder('MyContract', macrosDefaults);
+    const error = t.throws(() => setInfo(c, { securityContact: `security@example.com${ch}mod injected {}` }));
+    t.is((error as OptionsError).messages.securityContact, 'Must not contain line breaks');
+  });
+
+  test(`setInfo rejects ${name} in license`, t => {
+    const c = new ContractBuilder('MyContract', macrosDefaults);
+    const error = t.throws(() => setInfo(c, { license: `MIT${ch}mod injected {}` }));
+    t.is((error as OptionsError).messages.license, 'Must not contain line breaks');
+  });
+}
+
+test('setInfo accepts valid single-line values', t => {
+  const c = new ContractBuilder('MyContract', macrosDefaults);
+  t.notThrows(() => setInfo(c, { securityContact: 'security@example.com', license: 'MIT' }));
+});

packages/core/cairo/src/set-info.ts

@@ -1,7 +1,20 @@
 import type { ContractBuilder } from './contract';
+import { OptionsError } from './error';
 
 export const SECURITY_CONTACT_DOCUMENTATION = `Security contact: `;
 
+// These values are printed into a // comment line in the generated Cairo. LF
+// ends that comment, letting following text become source. CR and U+2028/U+2029
+// are rejected as defense in depth (review tools render U+2028/U+2029 as line
+// breaks).
+const LINE_TERMINATOR = /[\n\r\u2028\u2029]/u;
+
+function checkSingleLine(value: string, field: string): void {
+  if (LINE_TERMINATOR.test(value)) {
+    throw new OptionsError({ [field]: 'Must not contain line breaks' });
+  }
+}
+
 export const infoOptions = [{}, { license: 'WTFPL' }] as const;
 
 export const defaults: Info = { license: 'MIT' };
@@ -15,10 +28,12 @@ export function setInfo(c: ContractBuilder, info: Info): void {
   const { securityContact, license } = info;
 
   if (securityContact) {
+    checkSingleLine(securityContact, 'securityContact');
     c.addDocumentation(`${SECURITY_CONTACT_DOCUMENTATION}${securityContact}`);
   }
 
   if (license) {
+    checkSingleLine(license, 'license');
     c.license = license;
   }
 }

packages/core/cairo_alpha/src/set-info.test.ts

@@ -0,0 +1,33 @@
+import test from 'ava';
+
+import { ContractBuilder } from './contract';
+import { defaults as macrosDefaults } from './set-macros';
+import { setInfo } from './set-info';
+import type { OptionsError } from './error';
+
+const lineBreaks: [string, string][] = [
+  ['LF', '\n'],
+  ['CR', '\r'],
+  ['CRLF', '\r\n'],
+  ['LS', '\u2028'],
+  ['PS', '\u2029'],
+];
+
+for (const [name, ch] of lineBreaks) {
+  test(`setInfo rejects ${name} in securityContact`, t => {
+    const c = new ContractBuilder('MyContract', macrosDefaults);
+    const error = t.throws(() => setInfo(c, { securityContact: `security@example.com${ch}mod injected {}` }));
+    t.is((error as OptionsError).messages.securityContact, 'Must not contain line breaks');
+  });
+
+  test(`setInfo rejects ${name} in license`, t => {
+    const c = new ContractBuilder('MyContract', macrosDefaults);
+    const error = t.throws(() => setInfo(c, { license: `MIT${ch}mod injected {}` }));
+    t.is((error as OptionsError).messages.license, 'Must not contain line breaks');
+  });
+}
+
+test('setInfo accepts valid single-line values', t => {
+  const c = new ContractBuilder('MyContract', macrosDefaults);
+  t.notThrows(() => setInfo(c, { securityContact: 'security@example.com', license: 'MIT' }));
+});

packages/core/cairo_alpha/src/set-info.ts

@@ -1,7 +1,20 @@
 import type { ContractBuilder } from './contract';
+import { OptionsError } from './error';
 
 export const SECURITY_CONTACT_DOCUMENTATION = `Security contact: `;
 
+// These values are printed into a // comment line in the generated Cairo. LF
+// ends that comment, letting following text become source. CR and U+2028/U+2029
+// are rejected as defense in depth (review tools render U+2028/U+2029 as line
+// breaks).
+const LINE_TERMINATOR = /[\n\r\u2028\u2029]/u;
+
+function checkSingleLine(value: string, field: string): void {
+  if (LINE_TERMINATOR.test(value)) {
+    throw new OptionsError({ [field]: 'Must not contain line breaks' });
+  }
+}
+
 export const infoOptions = [{}, { license: 'WTFPL' }] as const;
 
 export const defaults: Info = { license: 'MIT' };
@@ -15,10 +28,12 @@ export function setInfo(c: ContractBuilder, info: Info): void {
   const { securityContact, license } = info;
 
   if (securityContact) {
+    checkSingleLine(securityContact, 'securityContact');
     c.addDocumentation(`${SECURITY_CONTACT_DOCUMENTATION}${securityContact}`);
   }
 
   if (license) {
+    checkSingleLine(license, 'license');
     c.license = license;
   }
 }

packages/core/solidity/src/set-info.test.ts

@@ -0,0 +1,32 @@
+import test from 'ava';
+
+import { ContractBuilder } from './contract';
+import { setInfo } from './set-info';
+import type { OptionsError } from './error';
+
+const lineBreaks: [string, string][] = [
+  ['LF', '\n'],
+  ['CR', '\r'],
+  ['CRLF', '\r\n'],
+  ['LS', '\u2028'],
+  ['PS', '\u2029'],
+];
+
+for (const [name, ch] of lineBreaks) {
+  test(`setInfo rejects ${name} in securityContact`, t => {
+    const c = new ContractBuilder('MyContract');
+    const error = t.throws(() => setInfo(c, { securityContact: `security@example.com${ch}contract Injected {}` }));
+    t.is((error as OptionsError).messages.securityContact, 'Must not contain line breaks');
+  });
+
+  test(`setInfo rejects ${name} in license`, t => {
+    const c = new ContractBuilder('MyContract');
+    const error = t.throws(() => setInfo(c, { license: `MIT${ch}contract Injected {}` }));
+    t.is((error as OptionsError).messages.license, 'Must not contain line breaks');
+  });
+}
+
+test('setInfo accepts valid single-line values', t => {
+  const c = new ContractBuilder('MyContract');
+  t.notThrows(() => setInfo(c, { securityContact: 'security@example.com', license: 'MIT' }));
+});

packages/core/solidity/src/set-info.ts

@@ -1,7 +1,20 @@
 import type { ContractBuilder } from './contract';
+import { OptionsError } from './error';
 
 export const TAG_SECURITY_CONTACT = `@custom:security-contact`;
 
+// LF and CR end a line comment in solc, letting following text escape the
+// generated comment line and become source. U+2028/U+2029 are also rejected:
+// solc errors on them, and review tools render them as line breaks. Other
+// control chars (VT/FF/NEL) error in solc too but cannot silently inject.
+const LINE_TERMINATOR = /[\n\r\u2028\u2029]/u;
+
+function checkSingleLine(value: string, field: string): void {
+  if (LINE_TERMINATOR.test(value)) {
+    throw new OptionsError({ [field]: 'Must not contain line breaks' });
+  }
+}
+
 export const infoOptions = [{}, { securityContact: 'security@example.com', license: 'WTFPL' }] as const;
 
 export const defaults: Info = { license: 'MIT' };
@@ -15,10 +28,12 @@ export function setInfo(c: ContractBuilder, info: Info) {
   const { securityContact, license } = info;
 
   if (securityContact) {
+    checkSingleLine(securityContact, 'securityContact');
     c.addNatspecTag(TAG_SECURITY_CONTACT, securityContact);
   }
 
   if (license) {
+    checkSingleLine(license, 'license');
     c.license = license;
   }
 }

packages/core/stellar/src/set-info.test.ts

@@ -0,0 +1,32 @@
+import test from 'ava';
+
+import { ContractBuilder } from './contract';
+import { setInfo } from './set-info';
+import type { OptionsError } from './error';
+
+const lineBreaks: [string, string][] = [
+  ['LF', '\n'],
+  ['CR', '\r'],
+  ['CRLF', '\r\n'],
+  ['LS', '\u2028'],
+  ['PS', '\u2029'],
+];
+
+for (const [name, ch] of lineBreaks) {
+  test(`setInfo rejects ${name} in securityContact`, t => {
+    const c = new ContractBuilder('MyContract');
+    const error = t.throws(() => setInfo(c, { securityContact: `security@example.com${ch}contract Injected {}` }));
+    t.is((error as OptionsError).messages.securityContact, 'Must not contain line breaks');
+  });
+
+  test(`setInfo rejects ${name} in license`, t => {
+    const c = new ContractBuilder('MyContract');
+    const error = t.throws(() => setInfo(c, { license: `MIT${ch}contract Injected {}` }));
+    t.is((error as OptionsError).messages.license, 'Must not contain line breaks');
+  });
+}
+
+test('setInfo accepts valid single-line values', t => {
+  const c = new ContractBuilder('MyContract');
+  t.notThrows(() => setInfo(c, { securityContact: 'security@example.com', license: 'MIT' }));
+});

packages/core/stellar/src/set-info.ts

@@ -1,4 +1,17 @@
 import type { ContractBuilder } from './contract';
+import { OptionsError } from './error';
+
+// These values are printed into a // comment line in the generated Rust. LF
+// ends that comment, letting following text become source. CR and U+2028/U+2029
+// cannot break out in Rust, but are rejected as defense in depth (review tools
+// render U+2028/U+2029 as line breaks).
+const LINE_TERMINATOR = /[\n\r\u2028\u2029]/u;
+
+function checkSingleLine(value: string, field: string): void {
+  if (LINE_TERMINATOR.test(value)) {
+    throw new OptionsError({ [field]: 'Must not contain line breaks' });
+  }
+}
 
 export const infoOptions = [{}, { license: 'WTFPL' }] as const;
 
@@ -10,7 +23,13 @@ export type Info = {
 };
 
 export function setInfo(c: ContractBuilder, { securityContact, license }: Info): void {
-  if (securityContact) c.addContractMetadata({ key: 'security_contact', value: securityContact });
+  if (securityContact) {
+    checkSingleLine(securityContact, 'securityContact');
+    c.addContractMetadata({ key: 'security_contact', value: securityContact });
+  }
 
-  if (license) c.license = license;
+  if (license) {
+    checkSingleLine(license, 'license');
+    c.license = license;
+  }
 }

packages/core/stylus/src/set-info.test.ts

@@ -0,0 +1,32 @@
+import test from 'ava';
+
+import { ContractBuilder } from './contract';
+import { setInfo } from './set-info';
+import type { OptionsError } from './error';
+
+const lineBreaks: [string, string][] = [
+  ['LF', '\n'],
+  ['CR', '\r'],
+  ['CRLF', '\r\n'],
+  ['LS', '\u2028'],
+  ['PS', '\u2029'],
+];
+
+for (const [name, ch] of lineBreaks) {
+  test(`setInfo rejects ${name} in securityContact`, t => {
+    const c = new ContractBuilder('MyContract');
+    const error = t.throws(() => setInfo(c, { securityContact: `security@example.com${ch}contract Injected {}` }));
+    t.is((error as OptionsError).messages.securityContact, 'Must not contain line breaks');
+  });
+
+  test(`setInfo rejects ${name} in license`, t => {
+    const c = new ContractBuilder('MyContract');
+    const error = t.throws(() => setInfo(c, { license: `MIT${ch}contract Injected {}` }));
+    t.is((error as OptionsError).messages.license, 'Must not contain line breaks');
+  });
+}
+
+test('setInfo accepts valid single-line values', t => {
+  const c = new ContractBuilder('MyContract');
+  t.notThrows(() => setInfo(c, { securityContact: 'security@example.com', license: 'MIT' }));
+});