@vibe-validate/utils 0.17.6 → 0.18.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/path-helpers.d.ts +9 -4
- package/dist/path-helpers.d.ts.map +1 -1
- package/dist/path-helpers.js +47 -18
- package/dist/path-helpers.js.map +1 -1
- package/dist/safe-exec.d.ts.map +1 -1
- package/dist/safe-exec.js +31 -43
- package/dist/safe-exec.js.map +1 -1
- package/package.json +1 -1
package/dist/path-helpers.d.ts
CHANGED
|
@@ -69,17 +69,22 @@ export declare function mkdirSyncReal(path: string, options?: Parameters<typeof
|
|
|
69
69
|
* Normalize any path (resolve short names on Windows)
|
|
70
70
|
*
|
|
71
71
|
* Utility to normalize paths without creating directories.
|
|
72
|
-
*
|
|
72
|
+
* Accepts multiple path segments like path.resolve() for convenience.
|
|
73
73
|
*
|
|
74
|
-
* @param
|
|
75
|
-
* @returns Real (normalized) path, or
|
|
74
|
+
* @param paths - Path segments to join and normalize
|
|
75
|
+
* @returns Real (normalized) path, or resolved path if normalization fails
|
|
76
76
|
*
|
|
77
77
|
* @example
|
|
78
78
|
* ```typescript
|
|
79
|
+
* // Single path
|
|
79
80
|
* const shortPath = 'C:\\PROGRA~1\\nodejs';
|
|
80
81
|
* const longPath = normalizePath(shortPath);
|
|
81
82
|
* // Result: 'C:\\Program Files\\nodejs'
|
|
83
|
+
*
|
|
84
|
+
* // Multiple segments (like path.resolve)
|
|
85
|
+
* const cliPath = normalizePath(__dirname, '../../dist/bin.js');
|
|
86
|
+
* // Resolves to absolute path AND normalizes short names
|
|
82
87
|
* ```
|
|
83
88
|
*/
|
|
84
|
-
export declare function normalizePath(
|
|
89
|
+
export declare function normalizePath(...paths: string[]): string;
|
|
85
90
|
//# sourceMappingURL=path-helpers.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"path-helpers.d.ts","sourceRoot":"","sources":["../src/path-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,SAAS,EAAgB,MAAM,SAAS,CAAC;
|
|
1
|
+
{"version":3,"file":"path-helpers.d.ts","sourceRoot":"","sources":["../src/path-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,SAAS,EAAgB,MAAM,SAAS,CAAC;AAKlD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAgBzC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,GACxC,MAAM,CAiBR;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,aAAa,CAAC,GAAG,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAmBxD"}
|
package/dist/path-helpers.js
CHANGED
|
@@ -36,13 +36,19 @@ import { tmpdir } from 'node:os';
|
|
|
36
36
|
export function normalizedTmpdir() {
|
|
37
37
|
const temp = tmpdir();
|
|
38
38
|
try {
|
|
39
|
-
//
|
|
40
|
-
return realpathSync(temp);
|
|
39
|
+
// Use native OS realpath for better Windows compatibility
|
|
40
|
+
return realpathSync.native(temp);
|
|
41
41
|
}
|
|
42
42
|
catch {
|
|
43
|
-
// Fallback
|
|
44
|
-
|
|
45
|
-
|
|
43
|
+
// Fallback to regular realpathSync
|
|
44
|
+
try {
|
|
45
|
+
// eslint-disable-next-line security/detect-non-literal-fs-filename -- Safe: temp is from tmpdir()
|
|
46
|
+
return realpathSync(temp);
|
|
47
|
+
}
|
|
48
|
+
catch {
|
|
49
|
+
// Last resort: return original
|
|
50
|
+
return temp;
|
|
51
|
+
}
|
|
46
52
|
}
|
|
47
53
|
}
|
|
48
54
|
/**
|
|
@@ -77,41 +83,64 @@ export function normalizedTmpdir() {
|
|
|
77
83
|
* ```
|
|
78
84
|
*/
|
|
79
85
|
export function mkdirSyncReal(path, options) {
|
|
80
|
-
// eslint-disable-next-line security/detect-non-literal-fs-filename --
|
|
86
|
+
// eslint-disable-next-line security/detect-non-literal-fs-filename -- This IS the mkdirSyncReal() implementation
|
|
81
87
|
mkdirSync(path, options);
|
|
82
88
|
try {
|
|
83
|
-
//
|
|
84
|
-
return realpathSync(path);
|
|
89
|
+
// Use native OS realpath for better Windows compatibility
|
|
90
|
+
return realpathSync.native(path);
|
|
85
91
|
}
|
|
86
92
|
catch {
|
|
87
|
-
// Fallback
|
|
88
|
-
|
|
89
|
-
|
|
93
|
+
// Fallback to regular realpathSync
|
|
94
|
+
try {
|
|
95
|
+
// eslint-disable-next-line security/detect-non-literal-fs-filename -- Safe: path is function parameter
|
|
96
|
+
return realpathSync(path);
|
|
97
|
+
}
|
|
98
|
+
catch {
|
|
99
|
+
// Last resort: return original
|
|
100
|
+
return path;
|
|
101
|
+
}
|
|
90
102
|
}
|
|
91
103
|
}
|
|
92
104
|
/**
|
|
93
105
|
* Normalize any path (resolve short names on Windows)
|
|
94
106
|
*
|
|
95
107
|
* Utility to normalize paths without creating directories.
|
|
96
|
-
*
|
|
108
|
+
* Accepts multiple path segments like path.resolve() for convenience.
|
|
97
109
|
*
|
|
98
|
-
* @param
|
|
99
|
-
* @returns Real (normalized) path, or
|
|
110
|
+
* @param paths - Path segments to join and normalize
|
|
111
|
+
* @returns Real (normalized) path, or resolved path if normalization fails
|
|
100
112
|
*
|
|
101
113
|
* @example
|
|
102
114
|
* ```typescript
|
|
115
|
+
* // Single path
|
|
103
116
|
* const shortPath = 'C:\\PROGRA~1\\nodejs';
|
|
104
117
|
* const longPath = normalizePath(shortPath);
|
|
105
118
|
* // Result: 'C:\\Program Files\\nodejs'
|
|
119
|
+
*
|
|
120
|
+
* // Multiple segments (like path.resolve)
|
|
121
|
+
* const cliPath = normalizePath(__dirname, '../../dist/bin.js');
|
|
122
|
+
* // Resolves to absolute path AND normalizes short names
|
|
106
123
|
* ```
|
|
107
124
|
*/
|
|
108
|
-
export function normalizePath(
|
|
125
|
+
export function normalizePath(...paths) {
|
|
126
|
+
// First resolve to absolute path (handles multiple segments)
|
|
127
|
+
const resolved = paths.length === 1
|
|
128
|
+
? paths[0]
|
|
129
|
+
: require('node:path').resolve(...paths);
|
|
109
130
|
try {
|
|
110
|
-
//
|
|
111
|
-
return realpathSync(
|
|
131
|
+
// Use native OS realpath for better Windows compatibility
|
|
132
|
+
return realpathSync.native(resolved);
|
|
112
133
|
}
|
|
113
134
|
catch {
|
|
114
|
-
|
|
135
|
+
// Fallback to regular realpathSync
|
|
136
|
+
try {
|
|
137
|
+
// eslint-disable-next-line security/detect-non-literal-fs-filename -- Safe: resolved is from path.resolve
|
|
138
|
+
return realpathSync(resolved);
|
|
139
|
+
}
|
|
140
|
+
catch {
|
|
141
|
+
// Last resort: return resolved path (better than original input)
|
|
142
|
+
return resolved;
|
|
143
|
+
}
|
|
115
144
|
}
|
|
116
145
|
}
|
|
117
146
|
//# sourceMappingURL=path-helpers.js.map
|
package/dist/path-helpers.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"path-helpers.js","sourceRoot":"","sources":["../src/path-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;
|
|
1
|
+
{"version":3,"file":"path-helpers.js","sourceRoot":"","sources":["../src/path-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAIjC;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,gBAAgB;IAE9B,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC;IACtB,IAAI,CAAC;QACH,0DAA0D;QAC1D,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,mCAAmC;QACnC,IAAI,CAAC;YACH,kGAAkG;YAClG,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,+BAA+B;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,UAAU,aAAa,CAC3B,IAAY,EACZ,OAAyC;IAEzC,iHAAiH;IACjH,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAEzB,IAAI,CAAC;QACH,0DAA0D;QAC1D,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,mCAAmC;QACnC,IAAI,CAAC;YACH,uGAAuG;YACvG,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,+BAA+B;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,aAAa,CAAC,GAAG,KAAe;IAC9C,6DAA6D;IAC7D,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC;QACjC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QACV,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;IAE3C,IAAI,CAAC;QACH,0DAA0D;QAC1D,OAAO,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,mCAAmC;QACnC,IAAI,CAAC;YACH,0GAA0G;YAC1G,OAAO,YAAY,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;YACjE,OAAO,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC;AACH,CAAC"}
|
package/dist/safe-exec.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"safe-exec.d.ts","sourceRoot":"","sources":["../src/safe-exec.ts"],"names":[],"mappings":"AAIA;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,kEAAkE;IAClE,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,iCAAiC;IACjC,KAAK,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC,CAAC;IACjE,6EAA6E;IAC7E,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,wBAAwB;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,0CAA0C;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8BAA8B;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,8BAA8B;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,sBAAsB;IACtB,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,qBAAqB;IACrB,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,8CAA8C;IAC9C,KAAK,CAAC,EAAE,KAAK,CAAC;CACf;AAED;;GAEG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,SAAgB,MAAM,EAAE,MAAM,CAAC;IAC/B,SAAgB,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACxC,SAAgB,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;gBAGtC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GAAG,MAAM,EACvB,MAAM,EAAE,MAAM,GAAG,MAAM;CAQ1B;
|
|
1
|
+
{"version":3,"file":"safe-exec.d.ts","sourceRoot":"","sources":["../src/safe-exec.ts"],"names":[],"mappings":"AAIA;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,kEAAkE;IAClE,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,iCAAiC;IACjC,KAAK,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC,CAAC;IACjE,6EAA6E;IAC7E,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,wBAAwB;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,0CAA0C;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8BAA8B;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,8BAA8B;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,sBAAsB;IACtB,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,qBAAqB;IACrB,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,8CAA8C;IAC9C,KAAK,CAAC,EAAE,KAAK,CAAC;CACf;AAED;;GAEG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,SAAgB,MAAM,EAAE,MAAM,CAAC;IAC/B,SAAgB,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACxC,SAAgB,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;gBAGtC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GAAG,MAAM,EACvB,MAAM,EAAE,MAAM,GAAG,MAAM;CAQ1B;AA4DD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,MAAM,EAAO,EACnB,OAAO,GAAE,eAAoB,GAC5B,MAAM,GAAG,MAAM,CAsCjB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,MAAM,EAAO,EACnB,OAAO,GAAE,eAAoB,GAC5B,cAAc,CAoChB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAOzD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,MAAM,EAChB,UAAU,GAAE,MAAoB,GAC/B,MAAM,GAAG,IAAI,CAUf;AAuBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,cAAc,CAAC,aAAa,EAAE,MAAM,GAAG;IACrD,cAAc,EAAE,OAAO,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CA0CA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AACH,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,MAAM,EACrB,OAAO,GAAE,eAAoB,GAC5B,MAAM,GAAG,MAAM,CAoBjB"}
|
package/dist/safe-exec.js
CHANGED
|
@@ -21,63 +21,51 @@ export class CommandExecutionError extends Error {
|
|
|
21
21
|
* ## Security Context
|
|
22
22
|
*
|
|
23
23
|
* This package's primary security model is `shell: false` to prevent command injection.
|
|
24
|
-
*
|
|
25
|
-
*
|
|
24
|
+
* Windows requires `shell: true` only for shell scripts (.cmd/.bat/.ps1) which require
|
|
25
|
+
* a shell interpreter by design (not executable binaries).
|
|
26
26
|
*
|
|
27
|
-
* ##
|
|
27
|
+
* ## Node.js on Windows - NO SHELL REQUIRED
|
|
28
28
|
*
|
|
29
|
-
*
|
|
29
|
+
* **Previous behavior (REMOVED):** Used shell:true for 'node' command
|
|
30
|
+
* **Problem discovered:** Node.js DEP0190 deprecation warning - passing args array with
|
|
31
|
+
* shell:true leads to incorrect command execution. Exit codes are ignored (always returns 0).
|
|
30
32
|
*
|
|
31
|
-
* **
|
|
32
|
-
* absolute path
|
|
33
|
+
* **Testing shows:**
|
|
34
|
+
* - ✅ `shell: false` + absolute path from `which.sync('node')` → Works correctly
|
|
35
|
+
* - ❌ `shell: true` + args array → Exit codes ignored, security warning
|
|
33
36
|
*
|
|
34
|
-
* **
|
|
35
|
-
*
|
|
36
|
-
* - ❌ Using `process.execPath` directly with `shell: false` → Same error
|
|
37
|
-
* - ✅ Using `shell: true` with command name → Works correctly
|
|
37
|
+
* **Root Cause of Previous ENOENT Issues:** Likely resolved in newer Node.js versions.
|
|
38
|
+
* Current testing (Node 20+) shows shell:false works correctly with absolute path.
|
|
38
39
|
*
|
|
39
|
-
*
|
|
40
|
-
* is needed to properly resolve and spawn node.exe, even with an absolute path.
|
|
40
|
+
* ## Why This Is Secure
|
|
41
41
|
*
|
|
42
|
-
*
|
|
43
|
-
*
|
|
44
|
-
*
|
|
45
|
-
*
|
|
46
|
-
*
|
|
47
|
-
*
|
|
48
|
-
* Despite using `shell: true`, command injection is prevented through multiple layers:
|
|
49
|
-
*
|
|
50
|
-
* 1. **Command Name Validation:** Only 'node' and known shell script extensions trigger shell mode
|
|
51
|
-
* 2. **Path Validation:** Command paths are resolved and validated via `which.sync()` before execution
|
|
52
|
-
* 3. **Array-Based Arguments:** Arguments are passed as an array (not a string), preventing injection
|
|
53
|
-
* 4. **Controlled Environment:** All commands come from trusted configuration, not user input
|
|
54
|
-
* 5. **No String Interpolation:** We never concatenate user input into command strings
|
|
55
|
-
*
|
|
56
|
-
* ## Compensating Controls
|
|
57
|
-
*
|
|
58
|
-
* - Arguments are validated to not contain null bytes (injection vector)
|
|
59
|
-
* - Command names come from trusted sources (vibe-validate config files)
|
|
60
|
-
* - Shell is NEVER used for arbitrary commands on Windows
|
|
61
|
-
* - Comprehensive security tests in `test/safe-exec.test.ts` (29 test cases)
|
|
42
|
+
* 1. **Minimal Shell Usage:** Shell only used for .cmd/.bat/.ps1 files (required)
|
|
43
|
+
* 2. **Path Validation:** Command paths resolved via `which.sync()` before execution
|
|
44
|
+
* 3. **Array-Based Arguments:** Arguments passed as array, preventing injection
|
|
45
|
+
* 4. **Controlled Environment:** Commands from trusted configuration, not user input
|
|
46
|
+
* 5. **No String Interpolation:** Never concatenate user input into command strings
|
|
62
47
|
*
|
|
63
48
|
* ## References
|
|
64
49
|
*
|
|
65
|
-
* -
|
|
66
|
-
* - Security tests: `packages/utils/test/safe-exec.test.ts`
|
|
67
|
-
* -
|
|
50
|
+
* - Node.js deprecation: https://nodejs.org/api/deprecations.html#DEP0190
|
|
51
|
+
* - Security tests: `packages/utils/test/safe-exec.test.ts`
|
|
52
|
+
* - Windows fix: PR #94 (fix/windows-shell-independence-v2)
|
|
68
53
|
*
|
|
69
|
-
* @param command - Command name (e.g., 'node', 'pnpm')
|
|
70
54
|
* @param commandPath - Resolved absolute path to command
|
|
71
55
|
* @returns true if shell should be used, false otherwise
|
|
72
56
|
*/
|
|
73
|
-
function shouldUseShell(
|
|
57
|
+
function shouldUseShell(commandPath) {
|
|
74
58
|
if (process.platform !== 'win32') {
|
|
75
59
|
return false;
|
|
76
60
|
}
|
|
77
|
-
// Node
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
61
|
+
// Node.js deprecation warning (DEP0190): Passing args with shell:true leads to incorrect
|
|
62
|
+
// command execution and security vulnerabilities. Testing shows shell:false works correctly
|
|
63
|
+
// with absolute path from which.sync('node') on Windows.
|
|
64
|
+
// Previous ENOENT issues may have been resolved in newer Node.js versions.
|
|
65
|
+
//
|
|
66
|
+
// REMOVED: if (command === 'node') return true;
|
|
67
|
+
// Reason: shell:true causes exit codes to be ignored (always returns 0)
|
|
68
|
+
// Fix: Use shell:false with absolute path - works correctly
|
|
81
69
|
// Windows shell scripts require shell by design (case-insensitive check)
|
|
82
70
|
const lowerPath = commandPath.toLowerCase();
|
|
83
71
|
return lowerPath.endsWith('.cmd') || lowerPath.endsWith('.bat') || lowerPath.endsWith('.ps1');
|
|
@@ -115,7 +103,7 @@ export function safeExecSync(command, args = [], options = {}) {
|
|
|
115
103
|
// Resolve command path using which (pure Node.js, no shell)
|
|
116
104
|
const commandPath = which.sync(command);
|
|
117
105
|
// Determine if shell is needed (Windows-specific logic)
|
|
118
|
-
const useShell = shouldUseShell(
|
|
106
|
+
const useShell = shouldUseShell(commandPath);
|
|
119
107
|
const spawnOptions = {
|
|
120
108
|
shell: useShell, // shell:true on Windows for node and shell scripts, shell:false otherwise for security
|
|
121
109
|
stdio: options.stdio ?? 'pipe',
|
|
@@ -162,7 +150,7 @@ export function safeExecResult(command, args = [], options = {}) {
|
|
|
162
150
|
try {
|
|
163
151
|
const commandPath = which.sync(command);
|
|
164
152
|
// Determine if shell is needed (Windows-specific logic)
|
|
165
|
-
const useShell = shouldUseShell(
|
|
153
|
+
const useShell = shouldUseShell(commandPath);
|
|
166
154
|
const spawnOptions = {
|
|
167
155
|
shell: useShell,
|
|
168
156
|
stdio: options.stdio ?? 'pipe',
|
package/dist/safe-exec.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"safe-exec.js","sourceRoot":"","sources":["../src/safe-exec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAyB,MAAM,oBAAoB,CAAC;AAEtE,OAAO,KAAK,MAAM,OAAO,CAAC;AAkC1B;;GAEG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9B,MAAM,CAAS;IACf,MAAM,CAAkB;IACxB,MAAM,CAAkB;IAExC,YACE,OAAe,EACf,MAAc,EACd,MAAuB,EACvB,MAAuB;QAEvB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED
|
|
1
|
+
{"version":3,"file":"safe-exec.js","sourceRoot":"","sources":["../src/safe-exec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAyB,MAAM,oBAAoB,CAAC;AAEtE,OAAO,KAAK,MAAM,OAAO,CAAC;AAkC1B;;GAEG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9B,MAAM,CAAS;IACf,MAAM,CAAkB;IACxB,MAAM,CAAkB;IAExC,YACE,OAAe,EACf,MAAc,EACd,MAAuB,EACvB,MAAuB;QAEvB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,SAAS,cAAc,CAAC,WAAmB;IACzC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,yFAAyF;IACzF,4FAA4F;IAC5F,yDAAyD;IACzD,2EAA2E;IAC3E,EAAE;IACF,gDAAgD;IAChD,wEAAwE;IACxE,4DAA4D;IAE5D,yEAAyE;IACzE,MAAM,SAAS,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;IAC5C,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAChG,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,YAAY,CAC1B,OAAe,EACf,OAAiB,EAAE,EACnB,UAA2B,EAAE;IAE7B,4DAA4D;IAC5D,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAExC,wDAAwD;IACxD,MAAM,QAAQ,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IAE7C,MAAM,YAAY,GAAqB;QACrC,KAAK,EAAE,QAAQ,EAAE,uFAAuF;QACxG,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,MAAM;QAC9B,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC;IAEF,yEAAyE;IACzE,qEAAqE;IACrE,MAAM,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;IACrD,MAAM,MAAM,GAAG,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;IAE1D,yBAAyB;IACzB,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,MAAM,CAAC,KAAK,CAAC;IACrB,CAAC;IAED,kBAAkB;IAClB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,qBAAqB,CAC7B,iCAAiC,MAAM,CAAC,MAAM,IAAI,SAAS,KAAK,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAC3F,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,EACnB,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,MAAM,CACd,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAe,EACf,OAAiB,EAAE,EACnB,UAA2B,EAAE;IAE7B,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAExC,wDAAwD;QACxD,MAAM,QAAQ,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;QAE7C,MAAM,YAAY,GAAqB;YACrC,KAAK,EAAE,QAAQ;YACf,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,MAAM;YAC9B,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAC;QAEF,qEAAqE;QACrE,MAAM,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;QACrD,MAAM,MAAM,GAAG,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;QAE1D,OAAO;YACL,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;YAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACxC,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACxC,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,yCAAyC;QACzC,OAAO;YACL,MAAM,EAAE,CAAC,CAAC;YACV,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;SACjE,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,IAAI,CAAC;QACH,YAAY,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC3D,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAgB,EAChB,aAAqB,WAAW;IAEhC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC,UAAU,CAAC,EAAE;YACnD,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,MAAM;SACd,CAAC,CAAC;QACH,OAAQ,OAAkB,CAAC,IAAI,EAAE,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAC7C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AACjD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAE1D;;GAEG;AACH,MAAM,qBAAqB,GAAG;IAC5B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE;IACnD,KAAK,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,UAAU,EAAE;IACrD,SAAS,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,YAAY,EAAE;IAChE,SAAS,EAAE,EAAE,IAAI,EAAE,2BAA2B,EAAE,OAAO,EAAE,sBAAsB,EAAE;CACzE,CAAC;AAEX;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,cAAc,CAAC,aAAqB;IAKlD,qDAAqD;IACrD,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QAEjC,sBAAsB;QACtB,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,OAAO;gBACL,cAAc,EAAE,IAAI;gBACpB,OAAO,EAAE,qBAAqB,CAAC,MAAM,CAAC,IAAI;gBAC1C,OAAO,EAAE,qBAAqB,CAAC,MAAM,CAAC,OAAO;aAC9C,CAAC;QACJ,CAAC;QAED,+BAA+B;QAC/B,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,OAAO;gBACL,cAAc,EAAE,IAAI;gBACpB,OAAO,EAAE,qBAAqB,CAAC,KAAK,CAAC,IAAI;gBACzC,OAAO,EAAE,qBAAqB,CAAC,KAAK,CAAC,OAAO;aAC7C,CAAC;QACJ,CAAC;QAED,8BAA8B;QAC9B,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,OAAO;gBACL,cAAc,EAAE,IAAI;gBACpB,OAAO,EAAE,qBAAqB,CAAC,SAAS,CAAC,IAAI;gBAC7C,OAAO,EAAE,qBAAqB,CAAC,SAAS,CAAC,OAAO;aACjD,CAAC;QACJ,CAAC;QAED,6BAA6B;QAC7B,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,OAAO;gBACL,cAAc,EAAE,IAAI;gBACpB,OAAO,EAAE,qBAAqB,CAAC,SAAS,CAAC,IAAI;gBAC7C,OAAO,EAAE,qBAAqB,CAAC,SAAS,CAAC,OAAO;aACjD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AACH,MAAM,UAAU,kBAAkB,CAChC,aAAqB,EACrB,UAA2B,EAAE;IAE7B,uDAAuD;IACvD,+EAA+E;IAC/E,MAAM,KAAK,GAAG,cAAc,CAAC,aAAa,CAAC,CAAC;IAC5C,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,uCAAuC,KAAK,CAAC,OAAO,KAAK;YACvD,aAAa,aAAa,MAAM;YAChC,4DAA4D;YAC5D,iCAAiC,KAAK,CAAC,OAAO,MAAM;YACpD,mEAAmE;YACnE,uEAAuE,CAC1E,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAE5B,OAAO,YAAY,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AAC9C,CAAC"}
|