Skip to content
Permalink
Browse files

Fix vulnerability in git-loader: use execFile instead of exec (#2470)

  • Loading branch information
dotansimha committed Jan 13, 2021
1 parent d27ed53 commit 6a966beee8ca8b2f4adfe93318b96e4a5c501eac
Showing with 10 additions and 5 deletions.
  1. +5 −0 .changeset/green-cycles-drive.md
  2. +5 −5 packages/loaders/git/src/load-git.ts
@@ -0,0 +1,5 @@
---
'@graphql-tools/git-loader': patch
---

Fix vulnerability: use execFile instead of exec
@@ -1,10 +1,10 @@
import { exec, execSync } from 'child_process';
import { execFile, execFileSync } from 'child_process';

type Input = { ref: string; path: string };

const createLoadError = (error: any) => new Error('Unable to load file from git: ' + error);
const createCommand = ({ ref, path }: Input) => {
return `git show ${ref}:${path}`;
const createCommand = ({ ref, path }: Input): string[] => {
return ['show', `${ref}:${path}`];
};

/**
@@ -13,7 +13,7 @@ const createCommand = ({ ref, path }: Input) => {
export async function loadFromGit(input: Input): Promise<string | never> {
try {
return await new Promise((resolve, reject) => {
exec(createCommand(input), { encoding: 'utf-8', maxBuffer: 1024 * 1024 * 1024 }, (error, stdout) => {
execFile('git', createCommand(input), { encoding: 'utf-8', maxBuffer: 1024 * 1024 * 1024 }, (error, stdout) => {
if (error) {
reject(error);
} else {
@@ -31,7 +31,7 @@ export async function loadFromGit(input: Input): Promise<string | never> {
*/
export function loadFromGitSync(input: Input): string | never {
try {
return execSync(createCommand(input), { encoding: 'utf-8' });
return execFileSync('git', createCommand(input), { encoding: 'utf-8' });
} catch (error) {
throw createLoadError(error);
}

0 comments on commit 6a966be

Please sign in to comment.