Skip to content

Commit 67fcce8

Browse files
committed
Prevents the cwd from being a valid resolution for exec
1 parent 360b43a commit 67fcce8

File tree

1 file changed

+22
-0
lines changed

1 file changed

+22
-0
lines changed

src/util/child.js

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@ import {ProcessSpawnError, ProcessTermError} from '../errors.js';
77
import {promisify} from './promise.js';
88

99
const child = require('child_process');
10+
const fs = require('fs');
11+
const path = require('path');
1012

1113
export const queue = new BlockingQueue('child', constants.CHILD_CONCURRENCY);
1214

@@ -15,7 +17,24 @@ let uid = 0;
1517

1618
export const exec = promisify(child.exec);
1719

20+
function validate(program: string, opts?: Object = {}) {
21+
if (program.includes('/')) {
22+
return true;
23+
}
24+
25+
const cwd = opts.cwd || process.cwd();
26+
const pathext = process.env.PATHEXT || '';
27+
28+
for (const ext of pathext.split(';')) {
29+
const candidate = path.join(cwd, `${program}${ext}`);
30+
if (fs.existsSync(candidate)) {
31+
throw new Error(`Potentially dangerous call to "${program}" in ${cwd}`);
32+
}
33+
}
34+
}
35+
1836
export function forkp(program: string, args: Array<string>, opts?: Object): Promise<number> {
37+
validate(program, opts);
1938
const key = String(++uid);
2039
return new Promise((resolve, reject) => {
2140
const proc = child.fork(program, args, opts);
@@ -32,6 +51,7 @@ export function forkp(program: string, args: Array<string>, opts?: Object): Prom
3251
}
3352

3453
export function spawnp(program: string, args: Array<string>, opts?: Object): Promise<number> {
54+
validate(program, opts);
3555
const key = String(++uid);
3656
return new Promise((resolve, reject) => {
3757
const proc = child.spawn(program, args, opts);
@@ -73,6 +93,8 @@ export function spawn(
7393
key,
7494
(): Promise<string> =>
7595
new Promise((resolve, reject) => {
96+
validate(program, opts);
97+
7698
const proc = child.spawn(program, args, opts);
7799
spawnedProcesses[key] = proc;
78100

0 commit comments

Comments
 (0)