Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Investigate Node 18.20.x security feature breaking our build process #15550

Open
IDCs opened this issue Apr 17, 2024 · 1 comment
Open

Investigate Node 18.20.x security feature breaking our build process #15550

IDCs opened this issue Apr 17, 2024 · 1 comment
Assignees
Labels
chore 💩 spike 🔎 An investigation task

Comments

@IDCs
Copy link
Contributor

IDCs commented Apr 17, 2024

A new security feature was introduced in NodeJS 18.20.x which is causing our build process to fail. We need to investigate whether a change needs to be made to Vortex's codebase or if this is a bug in Node.

node-red/node-red#4652

@IDCs IDCs self-assigned this Apr 17, 2024
@IDCs IDCs added the spike 🔎 An investigation task label Apr 18, 2024
@IDCs
Copy link
Contributor Author

IDCs commented Apr 18, 2024

Unfortunately we need to go through our codebase and add the shell: true property to all affected spawn calls. We have two potential solutions:

  • Go through the codebase manually and ensure we add the shell property (grindy task) - this will not affect 3rd party extensions and as a result any extensions that are not defining this property will potentially cease to work. (We need to review all 3rd party extensions to gauge the effect)
  • We can monkey patch the child_process.spawn function to ensure that the shell property is set when missing - this will affect 3rd party extensions and will ensure they're functioning (theoretically) and will simplify this task massively; BUT - monkey patching is evil and may create trouble in the long term.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
chore 💩 spike 🔎 An investigation task
Projects
None yet
Development

No branches or pull requests

1 participant