fix: invalid version fallback in pluginManager.service.ts (#11675)

This commit is contained in:
Anupam Mediratta
2026-09-12 10:21:46 +02:00
committed by GitHub
parent 953a539f2a
commit 202f3f5040
@@ -1,4 +1,4 @@
import { compare as semverCompare } from 'semver'
import { compare as semverCompare, valid as semverValid } from 'semver'
import { Observable, from, forkJoin, map, of } from 'rxjs'
import { Injectable, Inject } from '@angular/core'
import { Logger, LogService, PlatformService, BOOTSTRAP_DATA, BootstrapData, PluginInfo } from 'tabby-core'
@@ -84,6 +84,12 @@ export class PluginManagerService {
}
async installPlugin (plugin: PluginInfo): Promise<void> {
if (!/^(tabby|terminus)-[a-zA-Z0-9._-]+$/.test(plugin.packageName) || PLUGIN_BLACKLIST.includes(plugin.packageName)) {
throw new Error(`Refusing to install disallowed package: ${plugin.packageName}`)
}
if (!semverValid(plugin.version)) {
throw new Error(`Refusing to install package with invalid version: ${plugin.version}`)
}
try {
await this.platform.installPlugin(plugin.packageName, plugin.version)
this.installedPlugins = this.installedPlugins.filter(x => x.packageName !== plugin.packageName)