[APS-19009] resolve semgrep CI + allow legacy upper-case npm names

- Add justified nosemgrep for spawn-shell-true on both npm-install spawns
  (static argv, shell needed only for '>' redirect + npm.cmd on Windows).
- Sync securityValidation.js/utils.js with the path-join nosemgrep suppressions
  from the #1141 branch so the (false-positive) path-traversal findings clear.
- NPM_NAME_RE: allow A-Z so legacy registry names (e.g. JSONStream) are not
  rejected; still blocks git-url/file:/path/alternate-registry specs. Test added.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: Rohannagariya1

bin/helpers/packageInstaller.js

@@ -37,7 +37,11 @@ const setupPackageFolder = (runSettings, directoryPath) => {
         // before writing them to package.json, so a browserstack.json cannot smuggle a
         // git-url / file: / path / alternate-registry spec (dependency confusion or code
         // execution) into `npm install`.
-        const NPM_NAME_RE = /^(@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/;
+        // Allow upper-case too: legacy registry packages (e.g. JSONStream) have
+        // capitals and must not be rejected. This still blocks git-url / file: /
+        // path / alternate-registry specs (those contain :, /, .. which are not in
+        // the class), which is the actual dependency-confusion / RCE guard.
+        const NPM_NAME_RE = /^(@[a-zA-Z0-9-~][a-zA-Z0-9-._~]*\/)?[a-zA-Z0-9-~][a-zA-Z0-9-._~]*$/;
         const NPM_VERSION_RE = /^[A-Za-z0-9.\-+~^><=|*\s]+$/;
         for (const depName of Object.keys(combinedDependencies || {})) {
           const depVersion = combinedDependencies[depName];
@@ -117,9 +121,11 @@ const packageInstall = (packageDir, bsConfig) => {
     // output redirection and for invoking npm.cmd on Windows.
     if (parseInt(npm_major_version) >= 7) {
       logger.debug(`Running NPM install command: npm install --legacy-peer-deps --ignore-scripts --loglevel verbose > ../npm_install_debug.log`);
+      // nosemgrep: javascript.lang.security.audit.spawn-shell-true.spawn-shell-true -- static argv (see comment above); shell:true needed for '>' redirection + npm.cmd on Windows, no user input on the command line.
       nodeProcess = spawn(/^win/.test(process.platform) ? 'npm.cmd' : 'npm', ['install', '--legacy-peer-deps', '--ignore-scripts', '--loglevel', 'verbose', '>', '../npm_install_debug.log', '2>&1'], {cwd: packageDir, shell: true});
     } else {
       logger.debug(`Running NPM install command: 'npm install --ignore-scripts --loglevel verbose > ../npm_install_debug.log'`);
+      // nosemgrep: javascript.lang.security.audit.spawn-shell-true.spawn-shell-true -- static argv (see comment above); shell:true needed for '>' redirection + npm.cmd on Windows, no user input on the command line.
       nodeProcess = spawn(/^win/.test(process.platform) ? 'npm.cmd' : 'npm', ['install', '--ignore-scripts', '--loglevel', 'verbose', '>', '../npm_install_debug.log', '2>&1'], {cwd: packageDir, shell: true});
     }
     nodeProcess.on('close', nodeProcessCloseCallback);

bin/helpers/securityValidation.js

@@ -58,7 +58,9 @@ function isPathInsideBase(candidatePath, baseDir) {
   if (typeof candidatePath !== 'string' || candidatePath === '') {
     return false;
   }
+  // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal -- these resolves ARE the traversal guard: the value is normalized here only so the containment check below can reject anything outside `base`.
   const base = path.resolve(baseDir || process.cwd());
+  // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal -- see above; resolved path is validated by the startsWith(base) check, not used to read the FS unchecked.
   const resolved = path.resolve(base, candidatePath);
   // Must be the base itself or a descendant (base + separator prefix).
   return resolved === base || resolved.startsWith(base + path.sep);

bin/helpers/utils.js

@@ -39,6 +39,7 @@ exports.validateBstackJson = (bsConfigPath) => {
       // PR-supplied .js config would run arbitrary code, APS-19008). Also require
       // a .json extension and that the file resolves inside the project root so a
       // crafted --config-file cannot point outside the project or at a script.
+      // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal -- this resolve IS the traversal guard: the path is normalized here so the .json-extension + isPathInsideBase() containment checks below can reject anything outside the project root.
       const resolvedPath = path.resolve(bsConfigPath);
       if (path.extname(resolvedPath).toLowerCase() !== ".json") {
         return reject(`Invalid browserstack.json file. Error : config file must be a .json file.`);

test/unit/bin/helpers/packageInstaller.js

@@ -245,6 +245,38 @@ describe("packageInstaller", () => {
           sinon.assert.notCalled(fswriteFileSyncStub);
         });
     });
+
+    it("should accept a legacy upper-case npm package name (e.g. JSONStream) (APS-19009)", () => {
+      packageInstaller.__set__({
+        fileHelpers: {deletePackageArchieve: fileHelpersStub},
+        fs: {
+          mkdir: fsmkdirStub,
+          writeFileSync: fswriteFileSyncStub,
+          existsSync: fsexistsSyncStub,
+          copyFileSync: fscopyFileSyncStub
+        },
+        path: {
+          dirname: pathdirnameStub,
+          join: pathjoinStub
+        }
+      });
+      let setupPackageFolderrewire = packageInstaller.__get__('setupPackageFolder');
+      let runSettings = {
+        npm_dependencies: {
+          "JSONStream": "1.3.5"
+        }
+      };
+      let directoryPath = "/random/path";
+      return setupPackageFolderrewire(runSettings, directoryPath)
+        .then((data) => {
+          sinon.assert.calledOnce(fswriteFileSyncStub);
+          chai.assert.equal(data, "Package file created");
+        })
+        .catch((_error) => {
+          console.log(_error);
+          chai.assert.fail("legacy upper-case package name should be accepted");
+        });
+    });
   });
 
   context("packageInstall", () => {