@npmcli/run-script - npm Package Compare versions

Comparing version 4.1.3 to 4.1.4

lib/escape.js

@@ -68,5 +68,11 @@ 'use strict'
 
+// disabling the no-control-regex rule for this line as we very specifically _do_ want to
+// replace those characters if they somehow exist at this point, which is highly unlikely
+// eslint-disable-next-line no-control-regex
+const filename = (input) => input.replace(/[<>:"/\\|?*\x00-\x31]/g, '')
+
 module.exports = {
   cmd,
   sh,
+  filename,
 }

lib/make-spawn-args.js

@@ -33,2 +33,3 @@ /* eslint camelcase: "off" */
 
+  const fileName = escape.filename(`${event}-${Date.now()}`)
   let scriptFile
@@ -65,3 +66,3 @@ let script = ''
 
-    scriptFile = resolve(tmpdir(), `${event}-${Date.now()}.cmd`)
+    scriptFile = resolve(tmpdir(), `${fileName}.cmd`)
     script += '@echo off\n'
@@ -76,3 +77,3 @@ script += cmd
       : `#!/usr/bin/env ${scriptShell}`
-    scriptFile = resolve(tmpdir(), `${event}-${Date.now()}.sh`)
+    scriptFile = resolve(tmpdir(), `${fileName}.sh`)
     script += `${shebang}\n`
@@ -79,0 +80,0 @@ script += cmd

package.json

 {
   "name": "@npmcli/run-script",
-  "version": "4.1.3",
+  "version": "4.1.4",
   "description": "Run a lifecycle script for a package (descendant of npm-lifecycle)",
@@ -20,6 +20,2 @@ "author": "GitHub Inc.",
   },
-  "tap": {
-    "check-coverage": true,
-    "coverage-map": "map.js"
-  },
   "devDependencies": {
@@ -26,0 +22,0 @@ "@npmcli/eslint-config": "^3.0.1",

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

21270

increased by1.31%

Lines of code

410

increased by1.49%

No dependency changes