command-exists - npm Package Compare versions

Comparing version 1.2.0 to 1.2.1

lib/command-exists.js

@@ -5,12 +5,57 @@ 'use strict';
 var execSync = require('child_process').execSync;
+var access = require('fs').access;
+var accessSync = require('fs').accessSync;
+var constants = require('fs').constants;
 
 var isUsingWindows = process.platform == 'win32'
 
+var fileNotExists = function(commandName, callback){
+    access(commandName, constants.F_OK,
+    function(err){
+        callback(!err);
+    });
+};
+
+var fileNotExistsSync = function(commandName){
+    try{
+        accessSync(commandName, constants.F_OK);
+        return false;
+    }catch(e){
+        return true;
+    }
+};
+
+var localExecutable = function(commandName, callback){
+    access(commandName, constants.F_OK | constants.X_OK,
+        function(err){
+        callback(null, !err);
+    });
+};
+
+var localExecutableSync = function(commandName){
+    try{
+        accessSync(commandName, constants.F_OK | constants.X_OK);
+        return true;
+    }catch(e){
+        return false;
+    }
+}
+
 var commandExistsUnix = function(commandName, callback) {
-  var child = exec('command -v ' + commandName +
-        ' 2>/dev/null' +
-        ' && { echo >&1 \'' + commandName + ' found\'; exit 0; }',
-        function (error, stdout, stderr) {
-            callback(null, !!stdout);
-        });
+
+    fileNotExists(commandName, function(isFile){
+
+        if(!isFile){
+            var child = exec('command -v ' + commandName +
+                  ' 2>/dev/null' +
+                  ' && { echo >&1 \'' + commandName + ' found\'; exit 0; }',
+                  function (error, stdout, stderr) {
+                      callback(null, !!stdout);
+                  });
+            return;
+        }
+
+        localExecutable(commandName, callback);
+    });
+
 }
@@ -31,11 +76,16 @@
 var commandExistsUnixSync = function(commandName) {
-  try {
-    var stdout = execSync('command -v ' + commandName +
-          ' 2>/dev/null' +
-          ' && { echo >&1 \'' + commandName + ' found\'; exit 0; }'
-          );
-    return !!stdout;
-  } catch (error) {
-    return false;
+  if(fileNotExistsSync(commandName)){
+      try {
+        var stdout = execSync('command -v ' + commandName +
+              ' 2>/dev/null' +
+              ' && { echo >&1 \'' + commandName + ' found\'; exit 0; }'
+              );
+        return !!stdout;
+      } catch (error) {
+        return false;
+      }
   }
+
+  return localExecutableSync(commandName);
+
 }
@@ -42,0 +92,0 @@

package.json

 {
   "name": "command-exists",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "description": "check whether a command line command exists in the current environment",
   "main": "index.js",
   "scripts": {
-    "test": "mocha"
+    "test": "mocha test/test.js"
   },
@@ -9,0 +9,0 @@ "repository": {

test/test.js

@@ -71,2 +71,25 @@ 'use strict';
     });
+
+    describe('local file', function() {
+        it('it should report false if there is a non-executable file with that name', function(done) {
+            var commandToUse = 'test/non-executable-script.js'
+            commandExists(commandToUse)
+                .then(function(command){
+                    // We should not execute this line.
+                    expect(true).to.be(false);
+                }).catch(function(err){
+                    expect(err).to.be(null);
+                    done();
+                });
+        });
+        it('it should report true if there is an executable file with that name', function(done) {
+            var commandToUse = 'test/executable-script.js'
+            commandExists(commandToUse)
+                .then(function(command){
+                    // We should not execute this line.
+                    expect(command).to.be(commandToUse);
+                    done();
+                });
+        });
+    });
 });

New alerts

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

9818

increased by27.54%

Number of package files

10

increased by25%

Lines of code

192

increased by47.69%

Worsened metrics

Number of low supply chain risk alerts

3

increased byInfinity%

No dependency changes