Skip to content

fix shell command built from environment values #651

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
wants to merge 1 commit into from
Closed

fix shell command built from environment values #651

wants to merge 1 commit into from

Conversation

@odaysec
Copy link

@odaysec odaysec commented Jun 20, 2025

paypal-js/scripts/readme-package-version.js

Lines 3 to 15 in a2e716e

const { exec } = require("child_process");
const { version: newVersion } = require("../package.json");
const readmeFile = join(__dirname, "../", "README.md");
const readmeText = readFileSync(readmeFile, "utf-8");
const newReadmeText = readmeText.replace(
/[0-9]+\.[0-9]+\.[0-9]+\/dist\//g,
`${newVersion}/dist/`,
);
writeFileSync(readmeFile, newReadmeText, "utf-8");
exec(`git add ${readmeFile}`, (error) => {

Fix the issue will replace the use of exec with execFile, which allows us to pass arguments to the command as an array. This approach avoids the need to dynamically construct the shell command as a single string, thereby preventing the shell from misinterpreting special characters in the file path.

Specifically:

  1. Replace the exec call with execFile.
  2. Pass the git command as the first argument and the add subcommand along with the readmeFile path as separate elements in an array.
  3. Ensure the callback function remains unchanged to handle potential errors.

@odaysec odaysec requested a review from a team as a code owner June 20, 2025 05:31
@changeset-bot
Copy link

changeset-bot bot commented Jun 20, 2025

⚠️ No Changeset found

Latest commit: 99247c5

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@odaysec
Copy link
Author

odaysec commented Jul 17, 2025

ping @imbrian for merged this pull-request

@odaysec odaysec closed this by deleting the head repository Sep 17, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@odaysec