Skip to content
Permalink
Browse files Browse the repository at this point in the history
fix: quote spawn args
  • Loading branch information
xzhou-snyk committed Nov 29, 2022
1 parent 86090ee commit e8dd2a3
Show file tree
Hide file tree
Showing 3 changed files with 11 additions and 3 deletions.
11 changes: 8 additions & 3 deletions .snyk
@@ -1,5 +1,10 @@
# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
version: v1.13.5
ignore: {}
# patches apply the minimum changes required to fix a vulnerability
version: v1.25.0
# ignores vulnerabilities until expiry date; change duration by modifying expiry date
ignore:
'snyk:lic:npm:shescape:MPL-2.0':
- '*':
reason: None Given
expires: 2122-12-29T08:08:41.608Z
created: 2022-11-29T08:08:41.611Z
patch: {}
2 changes: 2 additions & 0 deletions lib/sub-process.ts
@@ -1,5 +1,6 @@
import * as childProcess from 'child_process';
import { debug } from './debug';
import { quoteAll } from 'shescape';

export function execute(
command: string,
Expand All @@ -12,6 +13,7 @@ export function execute(
if (options && options.cwd) {
spawnOptions.cwd = options.cwd;
}
args = quoteAll(args, spawnOptions);

return new Promise((resolve, reject) => {
let stdout = '';
Expand Down
1 change: 1 addition & 0 deletions package.json
Expand Up @@ -33,6 +33,7 @@
"@snyk/dep-graph": "^1.28.0",
"@snyk/mix-parser": "^1.1.1",
"debug": "^4.3.1",
"shescape": "1.6.1",
"tmp": "^0.0.33",
"tslib": "^2.0.0",
"upath": "2.0.1"
Expand Down

0 comments on commit e8dd2a3

Please sign in to comment.