Fix insecure shell escaping in facts tracker
Ben Alpert committed
Nov 30, 2016 at 10:38 UTC
cb2927665c3cac291c981f30ea039dc003854ea0
1 file changed
+40
-29
scripts/facts-tracker/index.js
+40
-29
@@ -13,19 +13,16 @@
13
14
var fs = require('fs');
15
var path = require('path');
16
-var execSync = require('child_process').execSync;
17
-
18
-function escape(value) {
19
- return '\'' + value.replace(/'/g, "'\\''") + '\'';
20
-}
16
+var execFileSync = require('child_process').execFileSync;
17
18
var cwd = null;
23
-function exec(command) {
19
+function exec(command, args) {
20
+ console.error('>', [command].concat(args));
21
var options = {};
22
if (cwd) {
23
options.cwd = cwd;
24
}
28
- return execSync(command, options).toString();
25
+ return execFileSync(command, args, options).toString();
26
}
27
28
@@ -67,12 +64,22 @@ if (isInsideOfTravis) {
64
}
65
66
exec(
70
- 'git config --global user.name ' +
71
- escape(process.env.GITHUB_USER_NAME || 'facts-tracker')
67
+ 'git',
68
+ [
69
+ 'config',
70
+ '--global',
71
+ 'user.name',
72
+ process.env.GITHUB_USER_NAME || 'facts-tracker',
73
+ ]
74
);
75
exec(
74
- 'git config --global user.email ' +
75
- escape(process.env.GITHUB_USER_EMAIL || 'facts-tracker@no-reply.github.com')
76
+ 'git',
77
+ [
78
+ 'config',
79
+ '--global',
80
+ 'user.email',
81
+ process.env.GITHUB_USER_EMAIL || 'facts-tracker@no-reply.github.com',
82
+ ]
83
);
84
}
85
@@ -86,7 +93,7 @@ function getRepoSlug() {
93
return process.env.TRAVIS_REPO_SLUG;
94
}
95
89
- var remotes = exec('git remote -v').split('\n');
96
+ var remotes = exec('git', ['remote', '-v']).split('\n');
97
for (var i = 0; i < remotes.length; ++i) {
98
var match = remotes[i].match(/^origin\t[^:]+:([^\.]+).+\(fetch\)/);
99
if (match) {
@@ -99,7 +106,7 @@ function getRepoSlug() {
106
}
107
108
var repoSlug = getRepoSlug();
102
-var currentCommitHash = exec('git rev-parse HEAD').trim();
109
+var currentCommitHash = exec('git', ['rev-parse', 'HEAD']).trim();
110
var currentTimestamp = new Date().toISOString()
111
.replace('T', ' ')
112
.replace(/\..+/, '');
@@ -107,29 +114,33 @@ var currentTimestamp = new Date().toISOString()
114
function checkoutFactsFolder() {
115
var factsFolder = '../' + repoSlug.split('/')[1] + '-facts';
116
if (!fs.existsSync(factsFolder)) {
110
- var escapedRepoURL;
117
+ var repoURL;
118
if (isInsideOfTravis) {
112
- escapedRepoURL = 'https://$GITHUB_USER@github.com/' + escape(repoSlug) + '.git';
119
+ repoURL = 'https://$GITHUB_USER@github.com/' + repoSlug + '.git';
120
} else {
114
- escapedRepoURL = escape('git@github.com:' + repoSlug + '.git');
121
+ repoURL = 'git@github.com:' + repoSlug + '.git';
122
}
123
124
exec(
118
- 'git clone ' +
119
- '--branch facts ' +
120
- '--depth=5 ' +
121
- escapedRepoURL + ' ' +
122
- escape(factsFolder)
125
+ 'git',
126
+ [
127
+ 'clone',
128
+ '--branch',
129
+ 'facts',
130
+ '--depth=5',
131
+ repoURL,
132
+ factsFolder,
133
+ ]
134
);
135
}
136
137
cwd = path.resolve(factsFolder);
127
- exec('git fetch');
128
- if (exec('git status --porcelain')) {
138
+ exec('git', ['fetch']);
139
+ if (exec('git', ['status', '--porcelain'])) {
140
console.error('facts-tracker: `git status` is not clean, aborting.');
141
process.exit(1);
142
}
132
- exec('git rebase origin/facts');
143
+ exec('git', ['rebase', 'origin/facts']);
144
}
145
checkoutFactsFolder();
146
@@ -146,7 +157,7 @@ for (var i = 2; i < process.argv.length; i += 2) {
157
158
var filename = name + '.txt';
159
try {
149
- var lastLine = exec('tail -n 1 ' + escape(filename));
160
+ var lastLine = exec('tail', ['-n', '1', filename]);
161
} catch (e) {
162
// ignore error
163
}
@@ -166,10 +177,10 @@ for (var i = 2; i < process.argv.length; i += 2) {
177
console.log(value);
178
}
179
169
-if (exec('git status --porcelain')) {
170
- exec('git add --all');
171
- exec('git commit -m ' + escape('Adding facts for ' + currentCommitHash));
172
- exec('git push origin facts');
180
+if (exec('git', ['status', '--porcelain'])) {
181
+ exec('git', ['add', '--all']);
182
+ exec('git', ['commit', '-m', 'Adding facts for ' + currentCommitHash]);
183
+ exec('git', ['push', 'origin', 'facts']);
184
} else {
185
console.error('facts-tracker: nothing to update');
186
}