The Wayback Machine - https://web.archive.org/web/20201123153121/https://github.com/shelljs/shelljs/pull/866
Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: add shell.cmd to replace exec #866

Merged
merged 1 commit into from Oct 30, 2019
Merged

feat: add shell.cmd to replace exec #866

merged 1 commit into from Oct 30, 2019

Conversation

@nfischer
Copy link
Member

@nfischer nfischer commented Jul 3, 2018

This adds an initial implementation of shell.cmd(), which is intended as
the eventual replacement for shell.exec(). This PR does not fully
implement the API, but demonstrates a simple and secure alternative, and
will allow further iteration to cover other use cases in follow-up PRs.

Design doc: https://shelljs.page.link/cmd-design

Issue #495
Test: automated test suite

@nfischer
Copy link
Member Author

@nfischer nfischer commented Jul 3, 2018

Apparently newlines are always converted to \n instead of os.EOL. Fixed in the second commit.

Windows has a separate issue with executing shx. Still looking into the correct fix.

@nfischer
Copy link
Member Author

@nfischer nfischer commented Jul 3, 2018

It turns out that Windows poses an extra issue. node_modules/.bin/ is populated with .bat files, but .bat and .cmd files require a shell. This is a major use case, so I think we have no choice but to enable the shell option on Windows and to resort to meta-character-escaping. I'll investigate and add a section to the doc.

src/cmd.js Outdated Show resolved Hide resolved
@nfischer
Copy link
Member Author

@nfischer nfischer commented Jul 17, 2018

Currently investigating Windows behavior on branch dns-cmd-on-win (which is not intended to be submitted, but it's easier to experiment with appveyor than to experiment locally).

@fernandopasik
Copy link

@fernandopasik fernandopasik commented Mar 6, 2019

would this fix the security issue described here? embarklabs/embark#1329

@nfischer
Copy link
Member Author

@nfischer nfischer commented Jul 8, 2019

Hi all! I would like to clarify: this pull request adds a new feature to our module. It is not a security fix.

shell.exec() is working as intended, and it is the dependent module's responsibility to use this method securely. Please see our security guidelines, and feel free to respond to #945 (comment) if you have further questions regarding Snyk or Github/WhiteSource's vulnerability reports.

@fernandopasik
Copy link

@fernandopasik fernandopasik commented Jul 8, 2019

Thank you for the clarification @nfischer and your hard work!

@codecov-io
Copy link

@codecov-io codecov-io commented Oct 23, 2019

Codecov Report

Merging #866 into master will increase coverage by 0.07%.
The diff coverage is 100%.

Impacted file tree graph

@@            Coverage Diff             @@
##           master     #866      +/-   ##
==========================================
+ Coverage   97.14%   97.22%   +0.07%     
==========================================
  Files          34       35       +1     
  Lines        1298     1332      +34     
==========================================
+ Hits         1261     1295      +34     
  Misses         37       37
Impacted Files Coverage Δ
commands.js 100% <ø> (ø) ⬆️
src/cmd.js 100% <100%> (ø)

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 05374a7...186412d. Read the comment docs.

This adds an initial implementation of shell.cmd(), which is intended as
the eventual replacement for shell.exec(). This PR does not fully
implement the API, but demonstrates a simple and secure alternative, and
will allow further iteration to cover other use cases in follow-up PRs.

Design doc: https://shelljs.page.link/cmd-design

Issue #495
Test: automated test suite
@nfischer nfischer force-pushed the simple-exec-alternative branch from 9a27e96 to 186412d Oct 29, 2019
@nfischer nfischer dismissed freitagbr’s stale review Oct 29, 2019

freitagbr is no longer active with the project

@nfischer nfischer merged commit a421b9e into master Oct 30, 2019
4 checks passed
4 checks passed
continuous-integration/appveyor/branch AppVeyor build succeeded
Details
continuous-integration/appveyor/pr AppVeyor build succeeded
Details
continuous-integration/travis-ci/pr The Travis CI build passed
Details
continuous-integration/travis-ci/push The Travis CI build passed
Details
@nfischer nfischer deleted the simple-exec-alternative branch Oct 30, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Linked issues

Successfully merging this pull request may close these issues.

None yet

4 participants
You can’t perform that action at this time.