Skip to content

Conversation

@alexsch01
Copy link
Contributor

@alexsch01 alexsch01 commented May 16, 2025

dang, my apologies for getting this out after the npm release

this prevents a performance/security regression with piping strings into npm/npx

This should block nodejs/node#58347


echo "Hello" | npm help a=1,b=2,c=3
No matches in help for: a=1 b=2 c=3

npm help a=1,b=2,c=3
No matches in help for: a=1,b=2,c=3

This is the best compromise between convenience and security

@alexsch01
Copy link
Contributor Author

alexsch01 commented May 20, 2025

Would be great to make it into 11.4.1
@owlstronaut @wraithgar

@alexsch01 alexsch01 mentioned this pull request May 21, 2025
@alexsch01
Copy link
Contributor Author

I was going to add a warning for the $ExpectingInput case when the $args variable contains an array as an element
but it doesn't cover the case of echo hello | npm start -- --arg1 --arg2, so I removed the warning

@alexsch01 alexsch01 marked this pull request as draft May 21, 2025 21:51
@alexsch01
Copy link
Contributor Author

Converting to a draft because it's missing some features

@alexsch01 alexsch01 deleted the branch npm:latest May 22, 2025 12:56
@alexsch01 alexsch01 closed this May 22, 2025
@alexsch01 alexsch01 deleted the latest branch May 22, 2025 12:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant