Switch from execSync to execFileSync #180

drazisil · 2020-05-19T13:52:34Z

No description provided.

lgtm-com · 2020-07-16T14:02:21Z

This pull request fixes 5 alerts when merging a4cc565 into 0c4d7f3 - view on LGTM.com

fixed alerts:

3 for Unsafe shell command constructed from library input
2 for Shell command built from environment values

lgtm-com · 2020-07-16T15:03:57Z

This pull request fixes 5 alerts when merging 2956ed4 into 0c4d7f3 - view on LGTM.com

fixed alerts:

3 for Unsafe shell command constructed from library input
2 for Shell command built from environment values

lgtm-com · 2020-07-16T15:21:50Z

This pull request fixes 5 alerts when merging 27792cc into 0c4d7f3 - view on LGTM.com

fixed alerts:

3 for Unsafe shell command constructed from library input
2 for Shell command built from environment values

lgtm-com · 2020-07-16T15:44:30Z

This pull request fixes 5 alerts when merging 46aed7b into 0c4d7f3 - view on LGTM.com

fixed alerts:

3 for Unsafe shell command constructed from library input
2 for Shell command built from environment values

lgtm-com · 2020-07-16T15:49:07Z

This pull request fixes 5 alerts when merging de77ff3 into 0c4d7f3 - view on LGTM.com

fixed alerts:

3 for Unsafe shell command constructed from library input
2 for Shell command built from environment values

lgtm-com · 2020-07-16T15:59:12Z

This pull request fixes 5 alerts when merging 7148c18 into 0c4d7f3 - view on LGTM.com

fixed alerts:

3 for Unsafe shell command constructed from library input
2 for Shell command built from environment values

drazisil · 2020-07-16T16:09:15Z

This is fixed on Linux/MacOS. I have no ideas how to make Windows work.

@eddiemoore , @edward-codecov , @hootener , @thomasrockhu , etc. Suggestions very welcome.

lgtm-com · 2020-07-16T16:10:09Z

This pull request fixes 5 alerts when merging e9bd861 into 0c4d7f3 - view on LGTM.com

fixed alerts:

3 for Unsafe shell command constructed from library input
2 for Shell command built from environment values

lgtm-com · 2020-07-16T16:39:44Z

This pull request fixes 5 alerts when merging caca56c into 0c4d7f3 - view on LGTM.com

fixed alerts:

3 for Unsafe shell command constructed from library input
2 for Shell command built from environment values

lgtm-com · 2020-07-16T17:43:59Z

This pull request fixes 5 alerts when merging 40caa82 into 0c4d7f3 - view on LGTM.com

fixed alerts:

3 for Unsafe shell command constructed from library input
2 for Shell command built from environment values

lib/codecov.js

Co-authored-by: Guillaume St-Pierre <guillaume@codecov.io>

lgtm-com · 2020-07-17T15:57:14Z

This pull request fixes 5 alerts when merging aa09765 into 5f6cc62 - view on LGTM.com

fixed alerts:

3 for Unsafe shell command constructed from library input
2 for Shell command built from environment values

lib/codecov.js

Co-authored-by: Guillaume St-Pierre <guillaume@codecov.io>

lgtm-com · 2020-07-17T16:07:34Z

This pull request fixes 5 alerts when merging 1dd9c25 into 5f6cc62 - view on LGTM.com

fixed alerts:

3 for Unsafe shell command constructed from library input
2 for Shell command built from environment values

lgtm-com · 2020-07-17T16:11:37Z

This pull request fixes 5 alerts when merging 9f0c2c9 into 5f6cc62 - view on LGTM.com

fixed alerts:

3 for Unsafe shell command constructed from library input
2 for Shell command built from environment values

ref: codecov#184 continuous from: ada583b codecov#180 makes `find` command change to run through `execFileSync()`. However, it always returns empty result because of the quote has over-included as the filename of search condition. So removed quotes from generated conditions. In addition, removing brackets from find arguments (a4cc565) has affected to the result of finding coverage files. This commit reverts brackets to get back the original search condition too. Previously quotes and escaped-brackets are required to run command on the shell environment, but no longer need them because of using `execFileSync()` that is disabled shell environment by default.

eddiemoore

I know it's already merged, but thought I should comment on it.

eddiemoore · 2020-07-23T07:27:07Z

lib/codecov.js

+      // It's not straightforward due to the nature of the find command
+      _findArgs = [root].concat(patterns)
+      if (more_patterns) {
+        _findArgs.concat(more_patterns)


concat doesn't mutate, it returns a new instance. So in this case you'd need to do _findArgs = _findArgs.concat(more_patterns)

eddiemoore · 2020-07-23T07:27:15Z

lib/codecov.js

+      _findArgs = [root].concat(winPatterns)
+      if (more_patterns) {
+        _findArgs.concat(more_patterns)
+      }
+      _files = execSync('dir ' + winPatterns.join(' ') + more_patterns)


Seems like nothing is happening with _findArgs in here.

eddiemoore · 2020-07-23T07:29:05Z

lib/codecov.js

-      _files = execSync('dir ' + patterns + more_patterns)
+      _findArgs = [root].concat(winPatterns)
+      if (more_patterns) {
+        _findArgs.concat(more_patterns)


Same thing here with concat doesn't mutate.

drazisil · 2020-07-23T12:04:51Z

Thanks, @eddiemoore. Can you throw together a PR and we'll get it fixed? (It might have already been, this version was broken and needed to be fixed.

Switch from execSync to execFileSync

b7c9e4e

drazisil force-pushed the CE-1846 branch from f9f04e1 to b7c9e4e Compare June 30, 2020 14:15

drazisil marked this pull request as ready for review June 30, 2020 14:17

drazisil requested a review from hootener June 30, 2020 14:17

drazisil added 2 commits June 30, 2020 10:52

Call existsSync instead of executing if

00f0a96

Trigger a build

43904fc

drazisil marked this pull request as draft July 10, 2020 15:29

I think this fixes linux and macos...

a4cc565

Only add more_patterns of it has a value. Correct windows.

2956ed4

Remove default value to more_patterns, change windows to winPatterns

27792cc

Try a colon.

46aed7b

Let's try not using MinGw...

de77ff3

What are the chances that Windows has a find?

7148c18

Put it back

e9bd861

drazisil marked this pull request as ready for review July 16, 2020 16:07

drazisil added 2 commits July 16, 2020 12:32

Reverting Windows side so this can me merged in time if needed.

caca56c

Reverting Windows side so this can me merged in time if needed.

40caa82

Minivera reviewed Jul 17, 2020

View reviewed changes

lib/codecov.js Outdated Show resolved Hide resolved

Update lib/codecov.js

aa09765

Co-authored-by: Guillaume St-Pierre <guillaume@codecov.io>

Minivera reviewed Jul 17, 2020

View reviewed changes

lib/codecov.js Outdated Show resolved Hide resolved

drazisil and others added 2 commits July 17, 2020 11:59

Update lib/codecov.js

1dd9c25

Co-authored-by: Guillaume St-Pierre <guillaume@codecov.io>

Set initial values

9f0c2c9

Minivera approved these changes Jul 17, 2020

View reviewed changes

drazisil merged commit c0711c6 into master Jul 17, 2020

drazisil deleted the CE-1846 branch July 17, 2020 16:20

yhatt mentioned this pull request Jul 21, 2020

Recover broken find pattern for UNIX #185

Merged

eddiemoore reviewed Jul 23, 2020

View reviewed changes

debricked-staging bot mentioned this pull request Jun 18, 2021

Bulk vulnerability fix - Lockfile fix philomather/test-vue#3

Open

debricked bot mentioned this pull request Jul 1, 2021

Bulk vulnerability fix - Lockfile fix AnExampleCompany/Repo1#3

Closed

debricked bot mentioned this pull request Sep 7, 2021

Bulk vulnerability fix - Lockfile fix AnExampleCompany/Repo1#6

Closed

debricked bot mentioned this pull request Oct 22, 2021

Bulk vulnerability fix - Lockfile fix AnExampleCompany/Repo1#7

Closed

debricked-staging bot mentioned this pull request Mar 29, 2022

Bulk vulnerability fix - Lockfile fix Luffare0/vue#1

Open

debricked-staging bot mentioned this pull request Jul 26, 2022

Fix CVE–2020–15123 Luffare0/vue#9

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Switch from execSync to execFileSync #180

Switch from execSync to execFileSync #180

drazisil commented May 19, 2020

lgtm-com bot commented Jul 16, 2020

lgtm-com bot commented Jul 16, 2020

lgtm-com bot commented Jul 16, 2020

lgtm-com bot commented Jul 16, 2020

lgtm-com bot commented Jul 16, 2020

lgtm-com bot commented Jul 16, 2020

drazisil commented Jul 16, 2020

lgtm-com bot commented Jul 16, 2020

lgtm-com bot commented Jul 16, 2020

lgtm-com bot commented Jul 16, 2020

lgtm-com bot commented Jul 17, 2020

lgtm-com bot commented Jul 17, 2020

lgtm-com bot commented Jul 17, 2020

eddiemoore left a comment

eddiemoore Jul 23, 2020

eddiemoore Jul 23, 2020

eddiemoore Jul 23, 2020

drazisil commented Jul 23, 2020

Switch from execSync to execFileSync #180

Switch from execSync to execFileSync #180

Conversation

drazisil commented May 19, 2020

lgtm-com bot commented Jul 16, 2020

lgtm-com bot commented Jul 16, 2020

lgtm-com bot commented Jul 16, 2020

lgtm-com bot commented Jul 16, 2020

lgtm-com bot commented Jul 16, 2020

lgtm-com bot commented Jul 16, 2020

drazisil commented Jul 16, 2020

lgtm-com bot commented Jul 16, 2020

lgtm-com bot commented Jul 16, 2020

lgtm-com bot commented Jul 16, 2020

lgtm-com bot commented Jul 17, 2020

lgtm-com bot commented Jul 17, 2020

lgtm-com bot commented Jul 17, 2020

eddiemoore left a comment

Choose a reason for hiding this comment

eddiemoore Jul 23, 2020

Choose a reason for hiding this comment

eddiemoore Jul 23, 2020

Choose a reason for hiding this comment

eddiemoore Jul 23, 2020

Choose a reason for hiding this comment

drazisil commented Jul 23, 2020