@nx/docker 22.7.6 → 22.7.8

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@nx/docker",
   "description": "The Nx Plugin for Docker to aid in containerizing projects.",
-  "version": "22.7.6",
+  "version": "22.7.8",
   "type": "commonjs",
   "publishConfig": {
     "access": "public"
@@ -51,11 +51,11 @@
   "executors": "./executors.json",
   "generators": "./generators.json",
   "dependencies": {
-    "@nx/devkit": "22.7.6",
+    "@nx/devkit": "22.7.8",
     "enquirer": "~2.3.6",
     "tslib": "^2.3.0"
   },
   "devDependencies": {
-    "nx": "22.7.6"
+    "nx": "22.7.8"
   }
 }

package/src/executors/release-publish/release-publish.impl.js

@@ -53,7 +53,9 @@ async function checkDockerImageExistsLocally(imageRef) {
             const normalizedImageRef = imageRef.startsWith('docker.io/')
                 ? imageRef.split('docker.io/')[1]
                 : imageRef;
-            const childProcess = (0, child_process_1.exec)(`docker images --filter "reference=${normalizedImageRef}" --quiet`, { encoding: 'utf8', windowsHide: true });
+            // Pass args as an array (no shell) so the reference read back from the
+            // .docker-version file can't break out into command injection.
+            const childProcess = (0, child_process_1.execFile)('docker', ['images', '--filter', `reference=${normalizedImageRef}`, '--quiet'], { encoding: 'utf8', windowsHide: true });
             let result = '';
             childProcess.stdout?.on('data', (data) => {
                 result += data;
@@ -77,7 +79,7 @@ async function checkDockerImageExistsLocally(imageRef) {
 async function dockerPush(imageReference, quiet) {
     try {
         return await new Promise((res, rej) => {
-            const childProcess = (0, child_process_1.exec)(`docker push ${imageReference}${quiet ? ' --quiet' : ''}`, {
+            const childProcess = (0, child_process_1.execFile)('docker', ['push', imageReference, ...(quiet ? ['--quiet'] : [])], {
                 encoding: 'utf8',
                 maxBuffer: exports.LARGE_BUFFER,
                 windowsHide: true,

package/src/release/version-utils.js

@@ -71,7 +71,9 @@ function updateProjectVersion(newVersion, nxDockerImageRefEnvOverride, workspace
     const newImageRef = getImageReference(projectRoot, repositoryName, registry);
     const fullImageRef = nxDockerImageRefEnvOverride ?? `${newImageRef}:${newVersion}`;
     if (!isDryRun) {
-        (0, child_process_1.execSync)(`docker tag ${imageRef} ${fullImageRef}`, {
+        // argv array, not a shell string - the image ref is assembled from workspace
+        // config, CLI flags and env, so it can't be trusted as shell input.
+        (0, child_process_1.execFileSync)('docker', ['tag', imageRef, fullImageRef], {
             windowsHide: true,
         });
     }