command-exists - npm Package Compare versions

Comparing version 1.2.2 to 1.2.3

lib/command-exists.js

@@ -101,6 +101,11 @@ 'use strict';
 
+var cleanInput = function(input) {
+  return '\''  + input.replace(/'/g, '\'\'') + '\'';
+}
+
 module.exports = function commandExists(commandName, callback) {
+  var cleanedCommandName = cleanInput(commandName);
   if (!callback && typeof Promise !== 'undefined') {
     return new Promise(function(resolve, reject){
-      commandExists(commandName, function(error, output){
+      commandExists(cleanedCommandName, function(error, output){
         if (output) {
@@ -115,5 +120,5 @@ resolve(commandName);
   if (isUsingWindows) {
-    commandExistsWindows(commandName, callback);
+    commandExistsWindows(cleanedCommandName, callback);
   } else {
-    commandExistsUnix(commandName, callback);
+    commandExistsUnix(cleanedCommandName, callback);
   }
@@ -123,7 +128,8 @@ };
 module.exports.sync = function(commandName) {
+  var cleanedCommandName = cleanInput(commandName);
   if (isUsingWindows) {
-    return commandExistsWindowsSync(commandName);
+    return commandExistsWindowsSync(cleanedCommandName);
   } else {
-    return commandExistsUnixSync(commandName);
+    return commandExistsUnixSync(cleanedCommandName);
   }
 };

package.json

 {
   "name": "command-exists",
-  "version": "1.2.2",
+  "version": "1.2.3",
   "description": "check whether a command line command exists in the current environment",
@@ -5,0 +5,0 @@ "main": "index.js",

README.md

@@ -10,3 +10,5 @@ command-exists
 
+```bash
 npm install command-exists
+```
 
@@ -13,0 +15,0 @@ ## usage

test/test.js

@@ -70,2 +70,6 @@ 'use strict';
         });
+
+        it('it should not execute some nefarious code', function(){
+            expect(commandExistsSync('ls; touch /tmp/foo0')).to.be(false);
+        });
     });
@@ -72,0 +76,0 @@

No alert changes

Improved metrics

Total package byte prevSize

10256

increased by4.04%

Lines of code

201

increased by4.15%

Number of lines in readme file

68

increased by3.03%

No dependency changes