From 6cce1065842ffaeaa6e9abe93c94100d157c8376 Mon Sep 17 00:00:00 2001
From: Lucian Rosu <lucian.rosu@snyk.io>
Date: Tue, 16 Aug 2022 09:39:56 +0300
Subject: [PATCH] fix: disable 'shell' for child processes

---
 lib/sub-process.ts        | 7 +++++--
 test/with-symlink.test.ts | 4 ++--
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/lib/sub-process.ts b/lib/sub-process.ts
index 7281e92..c76480d 100644
--- a/lib/sub-process.ts
+++ b/lib/sub-process.ts
@@ -1,7 +1,10 @@
 import * as childProcess from 'child_process';
 
-export function execute(command: string, args: string[], options?: { cwd?: string, env?: any }): Promise<string> {
-  const spawnOptions: childProcess.SpawnOptions = {shell: true};
+export function execute(command: string,
+                        args: string[],
+                        options?: { cwd?: string, env?: any },
+                        shell: boolean = false): Promise<string> {
+  const spawnOptions: childProcess.SpawnOptions = { shell };
   if (options?.cwd) {
     spawnOptions.cwd = options.cwd;
   }
diff --git a/test/with-symlink.test.ts b/test/with-symlink.test.ts
index a8921e8..8a7c73e 100644
--- a/test/with-symlink.test.ts
+++ b/test/with-symlink.test.ts
@@ -64,7 +64,7 @@ test('with nested GOPATH/src/proj symlink-ing to ../..', async(t) => {
   const cmd = `cd ${cwd} && ${exportEnvVarCmd} && ${execPluginCmd}`;
   return subProcess.execute(
     cmd,
-    [])
+    [], {}, true)
     .then((result) => {
       const resultJson = jsonParse(result);
 
@@ -143,7 +143,7 @@ test('package with broken symlink', async (t) => {
   const cmd = `cd ${cwd} && ${exportEnvVarCmd} && ${execPluginCmd}`;
   return subProcess.execute(
     cmd,
-    [])
+    [], {}, true)
     .then((result) => {
       const resultJson = jsonParse(result);