shell-quote - npm Package Compare versions

Comparing version 1.7.2 to 1.7.3

CHANGELOG.md

@@ -7,2 +7,6 @@ # acorn-node change log
 
+## 1.7.3
+* Fix a security issue where the regex for windows drive letters allowed some shell meta-characters
+to escape the quoting rules. (CVE-2021-42740)
+
 ## 1.7.2
@@ -9,0 +13,0 @@ * Fix a regression introduced in 1.6.3. This reverts the Windows path quoting fix. ([144e1c2](https://github.com/substack/node-shell-quote/commit/144e1c20cd57549a414c827fb3032e60b7b8721c))

index.js

@@ -13,3 +13,3 @@ exports.quote = function (xs) {
         else {
-            return String(s).replace(/([A-z]:)?([#!"$&'()*,:;<=>?@\[\\\]^`{|}])/g, '$1\\$2');
+            return String(s).replace(/([A-Za-z]:)?([#!"$&'()*,:;<=>?@\[\\\]^`{|}])/g, '$1\\$2');
         }
@@ -16,0 +16,0 @@ }).join(' ');

package.json

 {
   "name": "shell-quote",
   "description": "quote and parse shell commands",
-  "version": "1.7.2",
+  "version": "1.7.3",
   "author": {
@@ -6,0 +6,0 @@ "name": "James Halliday",

test/quote.js

@@ -43,1 +43,7 @@ var test = require('tape');
 })
+
+test("chars for windows paths don't break out", function (t) {
+    var x = '`:\\a\\b'
+    t.equal(quote([x]), '\\`\\:\\\\a\\\\b')
+    t.end()
+})

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

22234

increased by5.82%

Number of package files

18

increased by5.88%

Lines of code

418

increased by1.21%

No dependency changes