Skip to content
This repository has been archived by the owner on Aug 13, 2021. It is now read-only.

Security Fix for Remote Code Execution - huntr.dev #10

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
Open

Security Fix for Remote Code Execution - huntr.dev #10

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
e24d96e
Fixed Code Execution bug
Asjidkalam Jul 24, 2020
1cb9020
updated the fix
Asjidkalam Jul 24, 2020
c49a118
Merge pull request #1 from Asjidkalam/master
JamieSlome Jul 27, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 8 additions & 4 deletions index.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
*/

var concat = require('./reduceStream').concat;
var exec = require('child_process').exec;
var exec = require('child_process').execFile;
var Err = require('./errors');


Expand Down Expand Up @@ -68,7 +68,7 @@ function doNpmCommand(options, cb) {

// Check to make sure npm CLI is accessible
var NPM_V_OUTPUT = /^[0-9]+\.[0-9]+\.[0-9]+/;
var stdout$npm_v = exec('npm -v').stdout;
var stdout$npm_v = exec('npm', ['-v']).stdout;
concat(stdout$npm_v, function(err, result) {
if (err) return cb(err);
if (typeof result !== 'string' ||
Expand Down Expand Up @@ -109,9 +109,13 @@ function doNpmCommand(options, cb) {
// DRY:
// console.log('WOULD HAVE RUN::');
// console.log(cmd);


// Escaping bad arguments
var escape = cmd.split(" ");
var fileArg = escape.shift();

// Spin up child process
var npm = exec(cmd, {cwd: options.dir});
var npm = exec(fileArg, escape, {cwd: options.dir});
var stderr$npm = npm.stderr;
var stdout$npm = npm.stdout;

Expand Down