Comparing version 3.6.4 to 3.6.5
@@ -8,3 +8,2 @@ var fs = require('fs') | ||
var execSync = require('child_process').execSync | ||
var validator = require('validator') | ||
@@ -398,9 +397,9 @@ var detectProvider = require('./detect') | ||
'find ' + | ||
(args.options['gcov-root'] || root) + | ||
(sanitizeVar(args.options['gcov-root']) || root) + | ||
" -type f -name '*.gcno' " + | ||
gcg + | ||
' -exec ' + | ||
(validator.escape(args.options['gcov-exec']) || 'gcov') + | ||
(sanitizeVar(args.options['gcov-exec']) || 'gcov') + | ||
' ' + | ||
(validator.escape(args.options['gcov-args']) || '') + | ||
(sanitizeVar(args.options['gcov-args']) || '') + | ||
' {} +' | ||
@@ -414,5 +413,5 @@ } else { | ||
"') do " + | ||
(args.options['gcov-exec'] || 'gcov') + | ||
(sanitizeVar(args.options['gcov-exec']) || 'gcov') + | ||
' ' + | ||
(args.options['gcov-args'] || '') + | ||
(sanitizeVar(args.options['gcov-args']) || '') + | ||
' %g' | ||
@@ -562,3 +561,8 @@ } | ||
function sanitizeVar(arg) { | ||
return arg.replace(/&/g, '') | ||
} | ||
module.exports = { | ||
sanitizeVar: sanitizeVar, | ||
upload: upload, | ||
@@ -565,0 +569,0 @@ version: version, |
{ | ||
"name": "codecov", | ||
"version": "3.6.4", | ||
"version": "3.6.5", | ||
"description": "Uploading report to Codecov: https://codecov.io", | ||
@@ -38,4 +38,3 @@ "main": "index.js", | ||
"teeny-request": "6.0.1", | ||
"urlgrey": "0.4.4", | ||
"validator": "12.2.0" | ||
"urlgrey": "0.4.4" | ||
}, | ||
@@ -42,0 +41,0 @@ "devDependencies": { |
@@ -279,2 +279,8 @@ var fs = require('fs') | ||
}) | ||
it('can sanitize inputs', function() { | ||
expect(codecov.sanitizeVar('real & run unsafe & command')).toEqual( | ||
'real run unsafe command' | ||
) | ||
}) | ||
}) |
License Policy Violation
LicenseThis package is not allowed per your license policy. Review the package's license to ensure compliance.
Found 1 instance in 1 package
New author
Supply chain riskA new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.
Found 1 instance in 1 package
License Policy Violation
LicenseThis package is not allowed per your license policy. Review the package's license to ensure compliance.
Found 1 instance in 1 package
Telemetry
Supply chain riskThis package contains telemetry which tracks how it is used.
Found 1 instance in 1 package
75777
5
1985
0
6
- Removedvalidator@12.2.0
- Removedvalidator@12.2.0(transitive)