Skip to content
This repository has been archived by the owner on Feb 26, 2024. It is now read-only.

Fix: truffle unbox use spawnSync to run the post-install hook #5765

Open
wants to merge 2 commits into
base: develop
Choose a base branch
from
Open

Fix: truffle unbox use spawnSync to run the post-install hook #5765

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f5bc405
ignore stdio in execSync
GuillaumeRx Dec 7, 2022
681a96d
use spawnSync instead of execSync
GuillaumeRx Dec 8, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
9 changes: 7 additions & 2 deletions packages/box/lib/utils/unbox.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ import download from "download-git-repo";
import axios from "axios";
import vcsurl from "vcsurl";
import { parse as parseURL } from "url";
import { execSync } from "child_process";
import { spawnSync } from "child_process";
import inquirer from "inquirer";
import type { Question } from "inquirer";
import type { boxConfig, unboxOptions } from "typings";
Expand Down Expand Up @@ -148,7 +148,12 @@ function installBoxDependencies({ hooks }: boxConfig, destination: string) {
const postUnpack = hooks["post-unpack"];

if (postUnpack.length === 0) return;
execSync(postUnpack, { cwd: destination, stdio: "ignore" });

spawnSync(postUnpack, {
cwd: destination,
shell: true,
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Allow to run complex commands without parsing. ref: #5765 (comment)

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm concerned there's no sanitization checks on this arbitrary command as noted in the docs

If the shell option is enabled, do not pass unsanitized user input to this function. Any input containing shell metacharacters may be used to trigger arbitrary command execution.

stdio: ["ignore", process.stdout, process.stderr]
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ignore stdin and pipe stdout / stderr to parent process. I also piped stdout because - after looking at some boxes - most of them use --loglevel=error to elevate the logging to stderr.

execSync was previously left at its default config that didn't pipe stdout, now that it is with spawnSync the log level flag is not required anymore.

});
}

export = {
Expand Down