Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: pick fix parallel install from local directory (#398) #421

Merged
merged 1 commit into from
Oct 17, 2022

Conversation

vagusX
Copy link
Contributor

@vagusX vagusX commented Oct 17, 2022

Co-authored-by: Yiyu He dead_horse@qq.com

…m#412)

* fix: fix parallel install from local directory (cnpm#398)

* fix: parallel install from local directory

Co-authored-by: Yiyu He <dead_horse@qq.com>
@vagusX vagusX changed the title fix: pick fix parallel install from local directory (#398) (#412) fix: pick fix parallel install from local directory (#398) Oct 17, 2022
@@ -30,10 +30,13 @@
async function localFolder(filepath, pkg, options) {
debug(`install ${pkg.name}@${pkg.rawSpec} from local folder ${filepath}`);
try {
// everytime copy to a different directory to avoid parallel install
const tmpDir = path.join(options.storeDir, '.tmp', randomUUID());

Check warning

Code scanning / CodeQL

Unsafe shell command constructed from library input

[Path concatenation](1) which depends on [library input](2) is later used in [a shell command](3). [Path concatenation](1) which depends on [library input](4) is later used in [a shell command](3).
// use npm pack to ensure npmignore/gitignore/package.files work fine
const res = await utils.exec('npm pack', { cwd: filepath });
const res = await utils.exec(`npm pack --pack-destination ${tmpDir}`, { cwd: filepath });

Check warning

Code scanning / CodeQL

Unsafe shell command constructed from library input

[String concatenation](1) which depends on [library input](2) is later used in [a shell command](3). [String concatenation](1) which depends on [library input](4) is later used in [a shell command](3).
@lgtm-com
Copy link

lgtm-com bot commented Oct 17, 2022

This pull request introduces 2 alerts when merging c25134b into 1d7fbae - view on LGTM.com

new alerts:

  • 2 for Unsafe shell command constructed from library input

@fengmk2 fengmk2 added the bug label Oct 17, 2022
@gemwuu gemwuu merged commit 8170ce2 into cnpm:master Oct 17, 2022
@fengmk2
Copy link
Member

fengmk2 commented Oct 18, 2022

@gemwuu 版本发了回复上来。

@gemwuu
Copy link
Member

gemwuu commented Oct 18, 2022

  • npminstall@6.5.2

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants