Lines 39-79javascript
40* Validate and normalize a mount prefix before interpolating into shell commands.
41* Returns the normalized prefix (no leading/trailing slashes).
43* Shell safety is handled by shellQuote() at the call site, so this function
44* only enforces path-level rules (no traversal, no empty result, no control chars).
46function validatePrefix(prefix) {
47 let normalized = prefix;
48 while (normalized.startsWith("/")) normalized = normalized.slice(1);
49 while (normalized.endsWith("/")) normalized = normalized.slice(0, -1);
50 if (!normalized) throw new Error("Mount prefix cannot be empty after normalization.");
51 if (normalized.includes("//") || normalized.split("/").some((s) => s === "." || s === "..")) throw new Error(`Invalid mount prefix: "${
52 if (/[\x00-\x1f\x7f]/.test(normalized)) throw new Error(`Invalid mount prefix: "${prefix}". Control characters are not allowed.`);
56* Detect the system package manager available in the sandbox.
57* Returns 'apt' for Debian/Ubuntu, 'apk' for Alpine, or 'unknown'.
59async function detectPackageManager(sandbox) {
60 const pm = (await runCommand(sandbox, "which apt-get >/dev/null 2>&1 && echo \"apt\" || (which apk >/dev/null 2>&1 && echo \"apk\" || echo \"unknown\")")).stdout.trim();
61 if (pm === "apt") return "apt";
LowWeak Crypto
Package source references weak cryptographic algorithms.
dist/index.jsView on unpkg · L59 62 if (pm === "apk") return "apk";
66* Run a command in the Blaxel sandbox and return the result.
67* Wraps the process.exec API to match the command execution pattern used in mount operations.
69* Does NOT throw on non-zero exit codes — callers should check `exitCode` themselves.
71async function runCommand(sandbox, command, options) {
72 const result = await sandbox.process.exec({
74 waitForCompletion: true,
75 ...options?.timeout && { timeout: Math.ceil(options.timeout / 1e3) }
78 exitCode: result.exitCode ?? 0,
79 stdout: result.stdout ?? "",