Skip to content

fix(tools): use execFile instead of exec to avoid shell injection #5197

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
marcoscaceres wants to merge 9 commits into
base: main
Choose a base branch
from
+58 −40
Draft

fix(tools): use execFile instead of exec to avoid shell injection #5197

Changes from 4 commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
29ca83a
Potential fix for code scanning alert no. 47: Shell command built fro…
marcoscaceres Apr 13, 2026
93d014c
fix(tools): use execFile instead of exec to avoid shell injection
Copilot Apr 14, 2026
53eaa19
fix(tools): format splitArgs with prettier
Copilot Apr 14, 2026
3460e17
fix(tools): use structured args instead of regex parser
marcoscaceres Apr 17, 2026
0a7224b
fix(tools): accept string[] cmd to preserve quoted args and paths wit…
Copilot Apr 17, 2026
c4ed9bd
fix(tools): convert all command runner calls to array syntax
Copilot Apr 17, 2026
f5c767b
Merge branch 'main' into alert-autofix-47
marcoscaceres Apr 17, 2026
1704c95
chore(tools): remove dead string fallback in commandRunner
marcoscaceres Apr 17, 2026
963d7e5
Merge branch 'main' into alert-autofix-47
marcoscaceres Apr 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 16 additions & 11 deletions tools/release.cjs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
const { Builder } = require("./builder.cjs");
const cmdPrompt = require("prompt");
const colors = require("colors");
const { exec } = require("child_process");
const { execFile } = require("child_process");
const loading = require("loading-indicator");
const DEBUG = false;
const vnu = require("vnu-jar");
Expand Down Expand Up @@ -35,26 +35,30 @@ const loadOps = {
delay: 100,
};

/** @param {string} program */
function commandRunner(program) {
/**
* @param {string} file
* @param {string[]} [baseArgs]
*/
function commandRunner(file, baseArgs = []) {
/**
* @param {string} cmd
* @param {{showOutput: boolean}} [options ]
* @param {{showOutput: boolean}} [options]
*/
const runner = (cmd, options = { showOutput: false }) => {
console.log(colors.cyan(`Run: ${program} ${colors.grey(cmd)}`));
const args = [...baseArgs, ...cmd.split(/\s+/).filter(Boolean)];
console.log(colors.cyan(`Run: ${file} ${colors.grey(args.join(" "))}`));
Comment thread
marcoscaceres marked this conversation as resolved.
Outdated
if (DEBUG) {
return Promise.resolve("");
}
return toExecPromise(`${program} ${cmd}`, { ...options, timeout: 200000 });
return toExecFilePromise(file, args, { ...options, timeout: 200000 });
};
return runner;
}

const git = commandRunner("git");
const npm = commandRunner("npm");
const node = commandRunner("node");
const validator = commandRunner(`java -jar ${vnu}`);
const validator = commandRunner("java", ["-jar", vnu]);

cmdPrompt.start();

Expand Down Expand Up @@ -253,17 +257,18 @@ const Prompts = {

/**
*
* @param {string} cmd
* @param {string} file
* @param {string[]} args
* @param {{ timeout: number, showOutput: boolean }} options
* @returns {Promise<string>}
*/
function toExecPromise(cmd, { timeout, showOutput }) {
function toExecFilePromise(file, args, { timeout, showOutput }) {
return new Promise((resolve, reject) => {
const id = setTimeout(() => {
reject(new Error(`Command took too long: ${cmd}`));
reject(new Error(`Command took too long: ${file} ${args.join(" ")}`));
proc.kill("SIGTERM");
}, timeout);
const proc = exec(cmd, (err, stdout) => {
const proc = execFile(file, args, (err, stdout) => {
clearTimeout(id);
if (err) {
return reject(err);
Expand Down
Loading