fix: Command Injection Vuln

lib/gitfn.js

@@ -1,32 +1,44 @@
 'use strict'
 
-var child = require('child_process')
-
-function GitFn (version, options) {
-  this._version = version
-  this._options = {
-    cwd: options.dir,
-    env: process.env,
-    setsid: false,
-    stdio: [0, 1, 2]
+const child = require('child_process')
+const semver = require('semver')
+
+const assertVersionValid = version => {
+  if (!semver.valid(version)) {
+    throw new Error('version is invalid')
   }
 }
-module.exports = GitFn
 
-GitFn.prototype = {
-  tag: function (cb) {
-    var cmd = ['git', 'tag', 'v' + this._version].join(' ')
-    this._exec(cmd, cb)
-  },
-  untag: function (cb) {
-    var cmd = ['git', 'tag', '-d', 'v' + this._version].join(' ')
-    this._exec(cmd, cb)
-  },
-  commit: function (cb) {
-    var cmd = ['git', 'commit', '-am', '"' + this._version + '"'].join(' ')
-    this._exec(cmd, cb)
-  },
-  _exec: function (cmd, cb) {
-    child.exec(cmd, this._options, cb)
+const exec = (cmd, options, cb) => child.exec(cmd, options, cb)
+
+class GitFn {
+  constructor (version, options) {
+    this._version = version
+    this._options = {
+      cwd: options.dir,
+      env: process.env,
+      setsid: false,
+      stdio: [0, 1, 2]
+    }
+  }
+
+  tag (cb) {
+    assertVersionValid(this._version)
+    const cmd = ['git', 'tag', 'v' + this._version].join(' ')
+    exec(cmd, this._options, cb)
+  }
+
+  untag (cb) {
+    assertVersionValid(this._version)
+    const cmd = ['git', 'tag', '-d', 'v' + this._version].join(' ')
+    exec(cmd, this._options, cb)
+  }
+
+  commit (cb) {
+    assertVersionValid(this._version)
+    const cmd = ['git', 'commit', '-am', '"' + this._version + '"'].join(' ')
+    exec(cmd, this._options, cb)
   }
 }
+
+module.exports = GitFn

test/test.js

@@ -309,4 +309,14 @@ describe('change multiple files', function () {
       done()
     })
   })
+
+  it('shall throw if not a valid version', function (done) {
+    const gitFn = new Version._.GitFn('& touch newFile', { dir: './' })
+    try {
+      gitFn.tag(done)
+    } catch (e) {
+      assert.strictEqual(e.message, 'version is invalid')
+      done()
+    }
+  })
 })