Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update dependency shelljs to v0.8.5 [SECURITY] #54

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Update dependency shelljs to v0.8.5 [SECURITY] #54

wants to merge 1 commit into from

Conversation

renovate[bot]
Copy link

@renovate renovate bot commented Mar 7, 2022

WhiteSource Renovate

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
shelljs 0.3.0 -> 0.8.5 age adoption passing confidence

GitHub Vulnerability Alerts

GHSA-64g7-mvw6-v9qj

Impact

Output from the synchronous version of shell.exec() may be visible to other users on the same system. You may be affected if you execute shell.exec() in multi-user Mac, Linux, or WSL environments, or if you execute shell.exec() as the root user.

Other shelljs functions (including the asynchronous version of shell.exec()) are not impacted.

Patches

Patched in shelljs 0.8.5

Workarounds

Recommended action is to upgrade to 0.8.5.

References

https://huntr.dev/bounties/50996581-c08e-4eed-a90e-c0bac082679c/

For more information

If you have any questions or comments about this advisory:

CVE-2022-0144

shelljs is vulnerable to Improper Privilege Management

Release Notes

shelljs/shelljs

v0.8.5

Compare Source

This was a small security fix for #​1058.

v0.8.4

Compare Source

Small patch release to fix a circular dependency warning in node v14. See #​973.

v0.8.3

Compare Source

Full Changelog

Closed issues:

  • Shelljs print stderr to console even if exec-only "silent" is true #​905
  • refactor: remove common.state.tempDir #​902
  • Can't suppress stdout for echo #​899
  • exec() doesn't apply the arguments correctly #​895
  • shell.exec('npm pack') painfully slow #​885
  • shelljs.exec cannot find app.asar/node_modules/shelljs/src/exec-child.js #​881
  • test infra: mocks and skipOnWin conflict #​862
  • Support for shell function completion on IDE #​859
  • echo command shows options in stdout #​855
  • silent does not always work #​851
  • Appveyor installs the latest npm, instead of the latest compatible npm #​844
  • Force symbolic link (ln -sf) does not overwrite/recreate existing destination #​830
  • inconsistent result when trying to echo to a file #​798
  • Prevent require()ing executable-only files #​789
  • Cannot set property to of [object String] which has only a getter #​752
  • which() should check executability before returning a value #​657
  • Bad encoding experience #​456
  • phpcs very slow #​440
  • Error shown when triggering a sigint during shelljs.exec if process.on sigint is defined #​254
  • .to\(file\) does not mute STDIO output #​146
  • Escaping shell arguments to exec() #​143
  • Allow multiple string arguments for exec() #​103
  • cp does not recursively copy from readonly location #​98
  • Handling permissions errors on file I/O #​64

Merged pull requests:

v0.8.2

Compare Source

Full Changelog

Closed issues:

  • High severity vulnerability in shelljs 0.8.1 #​842
  • Add test for ls() on a symlink to a directory #​795
  • Harden shell.exec by writing the child process in a source file #​782
  • shell.exec() doesn't respond correctly to config.fatal = true #​735
  • Merge 'exec: internal error' with ShellJSInternalError #​734
  • exec returning null from command #​724
  • Only Get Stderr from Exec #​371
  • Execute child.stdout.on before child.on("exit") #​224

Merged pull requests:

v0.8.1

Compare Source

Full Changelog

Closed issues:

  • Exec failing with internal error when piping large output #​818

Merged pull requests:

v0.8.0

Compare Source

Full Changelog

Closed issues:

  • Snyk vulnerability DB reporting command injection vulnerability in ShellJS #​810
  • chore: upgrade nyc #​803
  • Update CI to use Node v9 #​799
  • Link to FAQ wiki section in our issue template #​787
  • Is it possible to get a js library(file) for ShellJS #​776
  • 48, #​774
  • 47 #​773
  • Exec function calls JSON.stringify on command #​772
  • getting different result from terminal and with shelljs #​769
  • test() does not support -w and -x options #​768
  • Snyk "high severity" issue #​766
  • Snyk "high security #​765
  • ShellJS doesn't respect NPM Registry being set outside of it #​761
  • Run second shell script #​756
  • shelljs seems NOT compatible with nexe under CentOS 6.5 #​754
  • Feature request: pushd/popd -q option #​753
  • cat doesn't support '-n' option #​750
  • shelljs run xcodebuild error #​749
  • Add wrappers around fs.statSync and fs.lstatSync #​745
  • Improve coverage for exec() #​742
  • Improve coverage for head() #​741
  • shelljs is no longer used in PDF.js #​737
  • ls doesn't follow links to directories #​733
  • Add test for ls regular-file.txt #​732
  • Clean up common tests #​714
  • Cant get encoding buffer to work on exec #​675
  • Set up Codecov for the project #​671
  • ShellJS: internal error Error: EBUSY: resource busy or locked, lstat 'C:\pagefile.sys' #​514
  • Feature request: provide a way to skip option parsing #​778
  • Switch to os.homedir() when we move to v4+ #​683
  • Drop support for v0.12 #​647
  • feature: echo -n #​559
  • Don't kill the node process upon unexpected error #​483
  • Echo doesn't return value ending in a trailing newline #​476
  • Synchronous exec stalls permenantly when there is an error/w the shell #​7

Merged pull requests:

v0.7.8

Compare Source

Full Changelog

Closed issues:

  • Add node v8 to CI #​729
  • Exec not working in Electron ! #​726
  • is rechoir used anywhere? #​723
  • ShellJS: internal error on shelljs.mkdir('myFile/myDir') #​720
  • Can't make sed perform global replace #​719
  • grep: option not recognized: l #​717
  • Problems getting code, stdout, stderr #​715
  • Copying hidden files fails on Windows 10 #​711
  • How am I suppose to handle errors with ShellJS? #​707
  • use cp('-r', './src', './dist') bug #​705
  • Way to ignore files in globs. #​699
  • Buffer constructor is deprecated #​694
  • source command not working via exec method. #​693
  • Would you be interested in a PR for open? #​692
  • Get rid of common.platform in favor of process.platform #​670
  • Passing empty string to cp throws internal error #​664
  • Why does sed split files into an array, call replace on each line and rejoin? #​645
  • feat: cp & mv should not overwrite recently created files #​631
  • Echo tests unnecessarily run tests in own process #​622
  • rm -rf on a symbolic link to a dir deletes its contents #​587
  • "Cannot extract package" with node-webkit #​181
  • EBADF, bad file descriptor #​180

Merged pull requests:

v0.7.7

Compare Source

Full Changelog

Closed issues:

  • Error output should be consistent across all platforms. #​681
  • *CRITICAL data loss* shell.cp() Content of file is erased when trying to copy it to the folder it already belongs to #​678
  • Use with webpack broken in 0.7.6 #​667
  • Difference between bash ls -R and ShellJS ls -R with symlinks #​666
  • Refactor which() (too many repeated code blocks) #​656
  • find() raises error when unable to find any files matching, expected to return empty array. #​653
  • Reformat the markdown in RELEASE.md #​642
  • rm -rf doesn't work if the directory contains an asar archive in Electron #​618
  • Add support for other file types in rm #​617
  • Feature request: ls -L option #​563
  • How to send SIGINT signal to child process launched with exec #​518
  • feature request: option to add node_modules to the path for shelljs scripts #​469
  • high cpu usage during synchronous exec #​167

Merged pull requests:

v0.7.6

Compare Source

Full Changelog

Closed issues:

  • unable to execute ionic command with shell js #​640
  • How to increase ShellJS buffer size? #​639
  • mkdir fails with non-normalized path #​634
  • Move execPath into common #​633
  • QUESTION: Feedback while an operation is running? #​629
  • Test setup/cleanup is broken #​621
  • Ignore temp directories when running lint #​620
  • parseOptions should throw an error if the option string doesn't start with '-' #​614
  • chore: LGTM.co is gone #​595
  • refactor: objectAssign should refer to Object.assign if it exists, or the internal polyfill otherwise #​592
  • parseOptions: allow a way to keep errors silent (exception only) #​591
  • [Question] commands with multiple options / arguments? #​589
  • feature: GNU Parallel #​585
  • write to file #​568
  • Cannot figure out how to disable globbing for rm #​567
  • Switch to the ava test framework #​560
  • Option not recognized #​556
  • chore: add @​freitagbr to LGTM maintainers #​552
  • chore: set up dev branch #​548
  • bug: cp() doesn't always copy everything #​547
  • User-friendly lint command #​544
  • Lint warning #​542
  • chore: add nodejs v7 to CI #​537
  • error.code is not always available #​536
  • Add shx as a dependency for testing #​525
  • Feature request: allow common.error\(\) to optionally not insert a prefix and optionally not print to console #​523
  • Feature request: Add "shelljs.unlink" #​519
  • Sed should allow a replacement string to contain \1 for match groups #​507
  • Usage with neodoc #​445
  • [ Feature idea ] synchronous sleep command #​441
  • Improve test coverage #​347
  • Add a way to prevent shell-expansion on commands (this issue is not for exec) #​345
  • Chown #​183
  • spawn EMFILE #​81
  • Rewrite exec using execsync-ng (which uses node-ffi) #​66
  • exec gets stuck on my Debian box #​51
  • 100% cpu usage when a nodejs script goes side ways executing a command. #​5

Merged pull requests:

v0.7.5

Compare Source

Full Changelog

Closed issues:

  • Project objectives: there is some higher goal to achieve? #​533
  • fs.existsSync is un-deprecated #​531
  • Inadvertent breaking change to shell.test() #​529
  • Add -u flag support for cp #​526
  • API request: allow plugin.error\(\) to take an options parameter #​522
  • FS Real Path error thrown when requiring shelljs #​521
  • Question: passing code via pipe? #​520
  • The performance in cp is different between 0.6.0 and 0.7.4 #​517
  • ShellJS in Electron package don't find ffmpeg anymore #​516
  • Exec issues with string option introduced in 0.7.4 #​515
  • [ Feature ] SSH command #​435

Merged pull requests:

v0.7.4

Compare Source

Full Changelog

Closed issues:

  • fix: echo -e should not print "-e" #​510
  • Wrong method signature in doc #​498
  • readFromPipe should be a function with no arguments #​485
  • TypeError: Cannot read property 'toString' of undefined #​471

Merged pull requests:

v0.7.3

Compare Source

Full Changelog

Closed issues:

  • expose execSync #​494
  • Add a way to create commands that can receive from a pipe without being standalone commands #​487
  • cp -r breaks when the directory contains a softlink #​193
  • Redirect output to file fails #​60
  • We need sed -n ? #​38

Merged pull requests:

v0.7.2

Compare Source

Full Changelog

Closed issues:

  • shelljs should not kill process if node call throws exception #​473
  • cp work incorrectly when folder name contains '@​' #​463
  • Something went wrong #​158

Merged pull requests:

v0.7.1

Compare Source

Full Changelog

Closed issues:

  • cp -n doesn't work correctly #​465
  • how can i run sudo apt-get install xtodotool by your plugin? #​448
  • shell.js grep: internal error, Invalid regular expression #​447
  • Stdout is empty on Git log command #​439
  • Cannot read toString of null when using execSync #​415
  • cp -R dir/ target fails to copy hidden files in dir #​140
  • #mv Won't Work Across Disks #​1

Merged pull requests:

v0.7.0

Compare Source

Full Changelog

Closed issues:

  • exec('nohup node some.js &') #​426
  • shelljs Breaks SemVer for Alpha and Pre-Release Versions #​390
  • Copy not accepting source end with wildcards * when using -r on v0.6.0 #​389
  • Support globbing in shjs #​388
  • Refactor more commands to return ShellString #​373
  • ln('-sf', './', '<destination>') is not linking the right folder #​363
  • v0.6.0 - shell.cp('r', '/foo/*, '/bar') fails with /foo/* no such file or directory #​342
  • Add documentup as a webhook #​327
  • Dir glob breaks when in the middle of path #​245
  • could you switch off wiki page? #​233
  • ls globbing does not behave like shell, consider using glob.sync #​225
  • Cannot run shell.exec('heroku config:push') -- just hangs #​218
  • cp does not overwrite files by default #​210
  • exec failed to return #​208
  • CLI Version #​202
  • Bracket expansion not working #​176
  • "exec" causes LiveScript interpreter (lsc) to hang #​160
  • Don't modify string prototype #​159
  • exec\(...\).to\(file\) should work #​154
  • Can't install shelljs locally instead of globally #​136
  • shelljs and node 0.10.28 #​125
  • Use case for global installed shelljs #​123
  • Only get stdout from exec #​92
  • What about other commands? #​90
  • Flesh out example of exit() #​73
  • exec doesn't work with qualified paths on windows #​41
  • exec does not working in mingw bash in windows #​17
  • Add support for cp -P option #​413
  • cp -L: Incorrect behavior for symlinks to regular files #​407
  • Edit the docs to emphasize ShellStrings and Pipes #​398
  • Error message isn't always printed #​372
  • Standardize command output #​356
  • exec() doesn't clean up all temp files #​353
  • Document that exec() options don't work on early versions of node #​350
  • Add -f option to set() #​344
  • Glob commands by default #​343
  • rm -rf incorrect behaviour #​332
  • Switch exec\(\) to use bash by default #​281
  • pipe to proc #​148
  • shell builtin #​138
  • add timeout option for exec #​132
  • shelljs cp handling symlinks badly #​69

Merged pull requests:

Configuration

📅 Schedule: "" (UTC).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, click this checkbox.

This PR has been generated by WhiteSource Renovate. View repository job log here.

@trafico-bot trafico-bot bot added the 🔍 Ready for Review Pull Request is not reviewed yet label Mar 7, 2022
@vizipi
Copy link

vizipi bot commented Mar 7, 2022

Pull request analysis by VIZIPI

Below you will find who is the most qualified team member to review your code.
This analysis includes his/her work on the code included in this Pull request, in addition to their experience in code affected by these changes ( partly found within the list of potential missing files below )   Feedback always welcome

No other active qualified developers found to review these specific changes. You might consider involving more team members with these code segments.

Potential missing files from this Pull request

No files found with a 40% threashold :)
No commonly committed files found with a 40% threashold

Committed file ranks

(click to expand)
  • 50.00%[package.json]

    • Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
    Reviewers
    No reviews
    Assignees
    No one assigned
    Labels
    🔍 Ready for Review Pull Request is not reviewed yet size/XS
    Projects
    None yet
    Milestone
    No milestone
    Development

    Successfully merging this pull request may close these issues.

    None yet
    1 participant
    @renovate-bot