Merge pull request #99 from snyk/fix/disable-shell-for-child-processes

fix: disable shell for child processes
snyk · Aug 17, 2022 · d8dfc11 · d8dfc11
2 parents 8fa65dc + 6cce106
commit d8dfc11
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 4 deletions.
diff --git a/lib/sub-process.ts b/lib/sub-process.ts
@@ -1,7 +1,10 @@
 import * as childProcess from 'child_process';
 
-export function execute(command: string, args: string[], options?: { cwd?: string, env?: any }): Promise<string> {
-  const spawnOptions: childProcess.SpawnOptions = {shell: true};
+export function execute(command: string,
+                        args: string[],
+                        options?: { cwd?: string, env?: any },
+                        shell: boolean = false): Promise<string> {
+  const spawnOptions: childProcess.SpawnOptions = { shell };
   if (options?.cwd) {
     spawnOptions.cwd = options.cwd;
   }

diff --git a/test/with-symlink.test.ts b/test/with-symlink.test.ts
@@ -64,7 +64,7 @@ test('with nested GOPATH/src/proj symlink-ing to ../..', async(t) => {
   const cmd = `cd ${cwd} && ${exportEnvVarCmd} && ${execPluginCmd}`;
   return subProcess.execute(
     cmd,
-    [])
+    [], {}, true)
     .then((result) => {
       const resultJson = jsonParse(result);
 
@@ -143,7 +143,7 @@ test('package with broken symlink', async (t) => {
   const cmd = `cd ${cwd} && ${exportEnvVarCmd} && ${execPluginCmd}`;
   return subProcess.execute(
     cmd,
-    [])
+    [], {}, true)
     .then((result) => {
       const resultJson = jsonParse(result);