@vscode/vsce 2.25.1-5 → 2.26.1-0

package/out/package.js

@@ -231,19 +231,35 @@ async function versionBump(options) {
     }
     // call `npm version` to do our dirty work
     const args = ['version', options.version];
-    if (options.commitMessage) {
-        args.push('-m', options.commitMessage);
+    const isWindows = process.platform === 'win32';
+    const commitMessage = isWindows ? sanitizeCommitMessage(options.commitMessage) : options.commitMessage;
+    if (commitMessage) {
+        args.push('-m', commitMessage);
     }
     if (!(options.gitTagVersion ?? true)) {
         args.push('--no-git-tag-version');
     }
-    const { stdout, stderr } = await (0, util_1.promisify)(cp.execFile)(process.platform === 'win32' ? 'npm.cmd' : 'npm', args, { cwd });
+    const { stdout, stderr } = await (0, util_1.promisify)(cp.execFile)(isWindows ? 'npm.cmd' : 'npm', args, { cwd, shell: isWindows /* https://nodejs.org/en/blog/vulnerability/april-2024-security-releases-2 */ });
     if (!process.env['VSCE_TESTS']) {
         process.stdout.write(stdout);
         process.stderr.write(stderr);
     }
 }
 exports.versionBump = versionBump;
+function sanitizeCommitMessage(message) {
+    if (!message) {
+        return undefined;
+    }
+    // Remove any unsafe characters found by the unsafeRegex
+    // Check for characters that might escape quotes or introduce shell commands.
+    // Don't allow: ', ", `, $, \ (except for \n which is allowed)
+    const sanitizedMessage = message.replace(/(?<!\\)\\(?!n)|['"`$]/g, '');
+    if (sanitizedMessage.length === 0) {
+        return undefined;
+    }
+    // Add quotes as commit message is passed as a single argument to the shell
+    return `"${sanitizedMessage}"`;
+}
 exports.Targets = new Set([
     'win32-x64',
     'win32-arm64',

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@vscode/vsce",
-	"version": "2.25.1-5",
+	"version": "2.26.1-0",
 	"description": "VS Code Extensions Manager",
 	"repository": {
 		"type": "git",