fix: address PR review — merge order, regex, prototype pollution

- Fix component input merge order: remove duplicate cliGlobalInputs
  spread that caused global CLI to override component-specific CLI
  inputs on key conflicts (P1)
- Broaden component name regex to allow '/' for paths like
  templates/deploy (P2)
- Add prototype pollution guard for __proto__, constructor,
  prototype keys in --input parsing (P1)
- Add 7 new tests covering edge cases
- Fix existing test that relied on buggy merge order

Author: Gyan Ranjan A

src/argv.ts

@@ -227,13 +227,18 @@ export class Argv {
         const val = this.map.get("input");
         const inputs: {[key: string]: any} = {};
         const pairs = typeof val == "string" ? val.split(" ") : val;
+        const dangerousKeys = new Set(["__proto__", "constructor", "prototype"]);
         (pairs ?? []).forEach((inputPair: string) => {
             // Support component-specific syntax: component:key=value or key=value
-            const exec = /(?:(?<component>[\w-]+):)?(?<key>[\w-]+)(=)(?<value>(.|\n|\r)*)/.exec(inputPair);
+            // Component names may contain word chars, hyphens, and slashes (e.g. templates/deploy)
+            const exec = /(?:(?<component>[\w\-/]+):)?(?<key>[\w-]+)(=)(?<value>(.|\n|\r)*)/.exec(inputPair);
             if (exec?.groups?.key) {
                 const value = exec?.groups?.value;
                 const key = exec.groups.key;
                 const component = exec.groups.component;
+
+                // Guard against prototype pollution
+                if (dangerousKeys.has(key) || dangerousKeys.has(component ?? "")) return;
 
                 // Try to parse as JSON for arrays/objects/booleans/numbers
                 let parsedValue;

src/parser-includes.ts

@@ -174,7 +174,7 @@ export class ParserIncludes {
                 const componentName = component.name.replace(/^templates\//, "");
                 const fileComponentInputs = isStructured ? (fileInputs[componentName] ?? {}) : {};
                 const cliComponentSpecificInputs = cliComponentInputs[componentName] ?? {};
-                const mergedInputs = {...(value.inputs ?? {}), ...globalInputs, ...fileComponentInputs, ...cliComponentSpecificInputs, ...cliGlobalInputs};
+                const mergedInputs = {...(value.inputs ?? {}), ...globalInputs, ...fileComponentInputs, ...cliComponentSpecificInputs};
                 const fileDoc = await Parser.loadYaml(file, {inputs: mergedInputs}, expandVariables, writeStreams);
                 // Expand local includes inside to a "project"-like include
                 fileDoc["include"] = this.expandInnerLocalIncludes(fileDoc["include"], component.projectPath, component.ref, opts);

tests/argv-input.test.ts

@@ -0,0 +1,41 @@
+import "../src/global.js";
+import {Argv} from "../src/argv.js";
+import {WriteStreamsMock} from "../src/write-streams.js";
+
+let writeStreams: WriteStreamsMock;
+
+beforeEach(() => {
+    writeStreams = new WriteStreamsMock();
+});
+
+test("input parses component names with slashes", async () => {
+    const argv = await Argv.build({input: ["templates/deploy:replicas=5"]}, writeStreams);
+    const result = argv.input;
+    expect(result["templates/deploy"]).toEqual({replicas: 5});
+});
+
+test("input keeps global and component keys separate", async () => {
+    const argv = await Argv.build({input: ["deploy:replicas=5", "environment=prod"]}, writeStreams);
+    const result = argv.input;
+    expect(result["deploy"]).toEqual({replicas: 5});
+    expect(result["environment"]).toEqual("prod");
+});
+
+test("input ignores __proto__ component to prevent prototype pollution", async () => {
+    const argv = await Argv.build({input: ["__proto__:polluted=true"]}, writeStreams);
+    const result = argv.input;
+    expect(Object.hasOwn(result, "__proto__")).toBe(false);
+    expect(({} as any).polluted).toBeUndefined();
+});
+
+test("input ignores __proto__ key to prevent prototype pollution", async () => {
+    const argv = await Argv.build({input: ["__proto__=true"]}, writeStreams);
+    const result = argv.input;
+    expect(Object.keys(result)).not.toContain("__proto__");
+});
+
+test("input ignores constructor key to prevent prototype pollution", async () => {
+    const argv = await Argv.build({input: ["constructor:toString=bad"]}, writeStreams);
+    const result = argv.input;
+    expect(Object.hasOwn(result, "constructor")).toBe(false);
+});

tests/test-cases/.gitignore

@@ -6,3 +6,4 @@ artifacts/log.txt
 !gitignore/.gitlab-ci-local
 !component-inputs-cli/.gitlab-ci-local-inputs.yml
 !component-inputs-multiple/.gitlab-ci-local-inputs.yml
+!component-inputs-edge-cases/.gitlab-ci-local-inputs.yml

tests/test-cases/component-inputs-edge-cases/.gitlab-ci-local-inputs.yml

@@ -0,0 +1,6 @@
+---
+_global:
+  environment: production
+
+deploy:
+  replicas: 3

tests/test-cases/component-inputs-edge-cases/.gitlab-ci.yml

@@ -0,0 +1,6 @@
+---
+include:
+  - component: $CI_SERVER_HOST/$CI_PROJECT_PATH/deploy@$CI_COMMIT_SHA
+
+stages:
+  - deploy

tests/test-cases/component-inputs-edge-cases/integration.test.ts

@@ -0,0 +1,55 @@
+import {WriteStreamsMock} from "../../../src/write-streams.js";
+import {handler} from "../../../src/handler.js";
+import {initSpawnSpy} from "../../mocks/utils.mock.js";
+import {WhenStatics} from "../../mocks/when-statics.js";
+
+beforeAll(() => {
+    initSpawnSpy(WhenStatics.all);
+});
+
+// Issue: component-specific CLI input must override global CLI input on key conflict
+test("component-specific CLI wins over global CLI on same key", async () => {
+    const writeStreams = new WriteStreamsMock();
+    await handler({
+        cwd: "tests/test-cases/component-inputs-edge-cases",
+        input: ["replicas=1", "deploy:replicas=10"],
+        preview: true,
+    }, writeStreams);
+
+    const expected = `---
+stages:
+  - .pre
+  - deploy
+  - .post
+deploy-production:
+  stage: deploy
+  script:
+    - echo "Deploying to production"
+    - echo "Replicas 10"`;
+
+    expect(writeStreams.stdoutLines[0]).toEqual(expected);
+});
+
+// Global CLI applies but file component-specific takes precedence
+test("file component-specific overrides global CLI", async () => {
+    const writeStreams = new WriteStreamsMock();
+    await handler({
+        cwd: "tests/test-cases/component-inputs-edge-cases",
+        input: ["replicas=7"],
+        preview: true,
+    }, writeStreams);
+
+    // File has deploy.replicas=3 (component-specific), which overrides global CLI replicas=7
+    const expected = `---
+stages:
+  - .pre
+  - deploy
+  - .post
+deploy-production:
+  stage: deploy
+  script:
+    - echo "Deploying to production"
+    - echo "Replicas 3"`;
+
+    expect(writeStreams.stdoutLines[0]).toEqual(expected);
+});

tests/test-cases/component-inputs-edge-cases/templates/deploy.yml

@@ -0,0 +1,15 @@
+---
+spec:
+  inputs:
+    environment:
+      type: string
+      default: dev
+    replicas:
+      type: number
+      default: 1
+---
+deploy-$[[ inputs.environment ]]:
+  stage: deploy
+  script:
+    - echo "Deploying to $[[ inputs.environment ]]"
+    - echo "Replicas $[[ inputs.replicas ]]"

tests/test-cases/component-inputs-multiple/integration.test.ts

@@ -33,14 +33,18 @@ build-job:
     expect(writeStreams.stdoutLines[0]).toEqual(expected);
 });
 
-test("component-inputs-multiple CLI overrides component-specific", async () => {
+test("component-inputs-multiple global CLI does not override file component-specific", async () => {
     const writeStreams = new WriteStreamsMock();
     await handler({
         cwd: "tests/test-cases/component-inputs-multiple",
         input: ["replicas=10", "go_version=\"1.22\""],
         preview: true,
     }, writeStreams);
 
+    // Global CLI inputs do NOT override file component-specific values.
+    // File has deploy.replicas=5 and build.go_version="1.21" (component-specific),
+    // so those take precedence over global CLI replicas=10 and go_version="1.22".
+    // Use component-specific CLI syntax (deploy:replicas=10) to override.
     const expected = `---
 stages:
   - .pre
@@ -50,11 +54,11 @@ stages:
 deploy-job:
   stage: deploy
   script:
-    - echo "Deploy to production with 10 replicas"
+    - echo "Deploy to production with 5 replicas"
 build-job:
   stage: build
   script:
-    - echo "Build with Go 1.22"
+    - echo "Build with Go 1.21"
     - echo "Cache true"`;
 
     expect(writeStreams.stdoutLines[0]).toEqual(expected);