+1
-1
| { | ||
| "name": "pre-git", | ||
| "description": "Automatically install pre-commit / pre-git hooks for your npm modules.", | ||
| "version": "3.14.1", | ||
| "version": "3.15.0", | ||
| "author": "Arnout Kazemier <opensource@observe.it>", | ||
@@ -6,0 +6,0 @@ "bin": { |
+8
-1
@@ -68,2 +68,9 @@ # pre-git | ||
| ### Subprojects | ||
| If you have large repo, it is possible that there might be nested files with | ||
| different `package.json` files. In this case, the search will proceed up | ||
| from the current working directory until it finds `package.json` with valis | ||
| `config.pre-git` object inside. | ||
| ## Windows | ||
@@ -247,3 +254,3 @@ | ||
| To see how `allow-untracked-files` option lets the commit go through, | ||
| To see how `allow-untracked-files` option lets the commit go through, | ||
| run `npm run test-allow-untracked-files` | ||
@@ -250,0 +257,0 @@ |
+44
-5
@@ -11,3 +11,4 @@ 'use strict'; | ||
| const log = require('debug')('pre-git'); | ||
| const packageName = 'pre-git'; | ||
| const log = require('debug')(packageName); | ||
| /* jshint -W079 */ | ||
@@ -19,2 +20,3 @@ var Promise = require('bluebird'); | ||
| var gitPrefix = process.env.GIT_PREFIX || ''; | ||
| log('git prefix env', process.env.GIT_PREFIX); | ||
@@ -41,2 +43,3 @@ function isAtRoot(dir) { | ||
| // finds package.json with config by going up the folder chain | ||
| function findPackage(dir) { | ||
@@ -46,7 +49,12 @@ var cwd = process.cwd(); | ||
| dir = path.join(cwd, gitPrefix); | ||
| log('set dir to %s for cwd %s and git prefix %s', dir, cwd, gitPrefix); | ||
| } | ||
| if (isPackageAmongFiles(dir)) { | ||
| log('found package in folder', dir); | ||
| return path.join(dir, 'package.json'); | ||
| const filename = path.join(dir, 'package.json'); | ||
| log('found package file %s', filename); | ||
| if (hasConfigInFile(filename)) { | ||
| log('file %s has %s config', filename, packageName); | ||
| return filename; | ||
| } | ||
| } | ||
@@ -85,3 +93,4 @@ | ||
| var gitRoot = output.trim(); | ||
| var projRoot = path.join(gitRoot, gitPrefix); | ||
| log('git root folder %s', gitRoot); | ||
| var projRoot = gitRoot; | ||
| var pkg; | ||
@@ -94,5 +103,19 @@ try { | ||
| catch (e) { | ||
| log('could not find package in the git root folder'); | ||
| return resolve(gitRoot); | ||
| } | ||
| if (!hasConfig(pkg)) { | ||
| log('package in %s does not have config', projRoot); | ||
| const rootPackageFile = findPackage(gitRoot); | ||
| if (rootPackageFile) { | ||
| const rootPackage = require(rootPackageFile); | ||
| if (hasConfig(rootPackage)) { | ||
| projRoot = path.dirname(rootPackageFile); | ||
| log('found %s config in git root folder %s', packageName, projRoot); | ||
| return resolve(projRoot); | ||
| } | ||
| } | ||
| } | ||
| if (pkg['pre-git-cwd']) { | ||
@@ -147,3 +170,2 @@ projRoot = path.resolve(path.join(gitRoot, pkg['pre-git-cwd'])); | ||
| function getConfig() { | ||
| const packageName = 'pre-git'; | ||
| const pkg = getPackage(); | ||
@@ -153,2 +175,11 @@ return pkg.config && pkg.config[packageName]; | ||
| function hasConfig(pkg) { | ||
| return Boolean(pkg && pkg.config && pkg.config[packageName]); | ||
| } | ||
| function hasConfigInFile(filename) { | ||
| const pkg = require(filename); | ||
| return hasConfig(pkg); | ||
| } | ||
| function getConfigProperty(propertyName) { | ||
@@ -297,2 +328,9 @@ const config = getConfig(); | ||
| if (root !== process.cwd()) { | ||
| log('switching current folder from %s to %s', | ||
| process.cwd(), root); | ||
| } else { | ||
| log('cwd %s', process.cwd()); | ||
| } | ||
| if (label === 'pre-commit') { | ||
@@ -303,2 +341,3 @@ return hasUntrackedFiles() | ||
| } | ||
| return runTasksForLabel(); | ||
@@ -305,0 +344,0 @@ } |
Shell access
Supply chain riskThis module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.
Found 1 instance in 1 package
Dynamic require
Supply chain riskDynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.
Found 1 instance in 1 package
Environment variable access
Supply chain riskPackage accesses environment variables, which may be a sign of credential stuffing or data theft.
Found 3 instances in 1 package
Filesystem access
Supply chain riskAccesses the file system, and could potentially read sensitive data.
Found 1 instance in 1 package
Shell access
Supply chain riskThis module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.
Found 1 instance in 1 package
Dynamic require
Supply chain riskDynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.
Found 1 instance in 1 package
Environment variable access
Supply chain riskPackage accesses environment variables, which may be a sign of credential stuffing or data theft.
Found 3 instances in 1 package
Filesystem access
Supply chain riskAccesses the file system, and could potentially read sensitive data.
Found 1 instance in 1 package
42756
3.66%857
4.13%312
2.3%14
27.27%