shescape - npm Package Compare versions

Comparing version 1.3.0 to 1.3.1

CHANGELOG.md

@@ -12,2 +12,6 @@ # Changelog
 
+## [1.3.1] - 2021-12-06
+
+- Add default shell detection.
+
 ## [1.3.0] - 2021-12-05
@@ -14,0 +18,0 @@

index.js

@@ -11,3 +11,3 @@ /**
  * @module shescape
- * @version 1.3.0
+ * @version 1.3.1
  * @license MPL-2.0
@@ -35,4 +35,5 @@ * @author Eric Cornelissen <[e-mail]>
   const shell = options.shell;
+  const env = process.env;
   const platform = os.platform();
-  return main.escapeShellArgByPlatform(arg, platform, shell);
+  return main.escapeShellArgByPlatform(arg, platform, env, shell);
 }
@@ -58,6 +59,7 @@
   const shell = options.shell;
+  const env = process.env;
   const platform = os.platform();
   const result = [];
   for (const arg of args) {
-    const safeArg = main.escapeShellArgByPlatform(arg, platform, shell);
+    const safeArg = main.escapeShellArgByPlatform(arg, platform, env, shell);
     result.push(safeArg);
@@ -84,4 +86,5 @@ }
   const shell = options.shell;
+  const env = process.env;
   const platform = os.platform();
-  return main.quoteShellArgByPlatform(arg, platform, shell);
+  return main.quoteShellArgByPlatform(arg, platform, env, shell);
 }
@@ -107,6 +110,7 @@
   const shell = options.shell;
+  const env = process.env;
   const platform = os.platform();
   const result = [];
   for (const arg of args) {
-    const safeArg = main.quoteShellArgByPlatform(arg, platform, shell);
+    const safeArg = main.quoteShellArgByPlatform(arg, platform, env, shell);
     result.push(safeArg);
@@ -113,0 +117,0 @@ }

package.json

 {
   "name": "shescape",
-  "version": "1.3.0",
+  "version": "1.3.1",
   "description": "simple shell escape library",
@@ -5,0 +5,0 @@ "homepage": "https://ericcornelissen.github.io/shescape/",

src/constants.js

@@ -15,2 +15,10 @@ /**
 /**
+ * @constant {string} shellRequiredError The error message for when the shell
+ * argument is missing.
+ * @example throw new TypeError(shellRequiredError);
+ */
+export const shellRequiredError =
+  "Shescape requires a shell to be specified in order to escape arguments";
+
+/**
  * @constant {string} typeError The error message for incorrect parameter types.
@@ -17,0 +25,0 @@ */

src/main.js

@@ -27,2 +27,23 @@ /**
 /**
+ * Get the shell to escape arguments for.
+ *
+ * @param {string} platform The platform to get the shell for.
+ * @param {Object} env The environment variables.
+ * @param {string} [shell] The provided shell, if any.
+ * @returns The shell to escape arguments for.
+ */
+function getShell(platform, env, shell) {
+  if (shell !== undefined) {
+    return shell;
+  }
+
+  switch (platform) {
+    case win32:
+      return win.getDefaultShell(env);
+    default:
+      return unix.getDefaultShell();
+  }
+}
+
+/**
  * Take a value and escape any dangerous characters.
@@ -34,7 +55,8 @@ *
  * @param {string} platform The platform to escape the argument for.
- * @param {string} [shell] The shell to escape the argument for.
+ * @param {Object} env The environment variables.
+ * @param {string} [shell] The shell to escape the argument for, if any.
  * @returns {string} The escaped argument.
  * @throws {TypeError} The argument is not stringable.
  */
-export function escapeShellArgByPlatform(arg, platform, shell) {
+export function escapeShellArgByPlatform(arg, platform, env, shell) {
   if (!isStringable(arg)) {
@@ -44,2 +66,3 @@ throw new TypeError(typeError);
 
+  shell = getShell(platform, env, shell);
   const argAsString = arg.toString();
@@ -50,3 +73,3 @@ switch (platform) {
     default:
-      return unix.escapeShellArg(argAsString);
+      return unix.escapeShellArg(argAsString, shell);
   }
@@ -63,8 +86,9 @@ }
  * @param {string} platform The platform to escape and quote the argument for.
- * @param {string} [shell] The shell to escape and quote the argument for.
+ * @param {Object} env The environment variables.
+ * @param {string} [shell] The shell to escape the argument for, if any.
  * @returns {string} The escaped argument.
  * @throws {TypeError} The argument is not stringable.
  */
-export function quoteShellArgByPlatform(arg, platform, shell) {
-  const safeArg = escapeShellArgByPlatform(arg, platform, shell);
+export function quoteShellArgByPlatform(arg, platform, env, shell) {
+  const safeArg = escapeShellArgByPlatform(arg, platform, env, shell);
   switch (platform) {
@@ -71,0 +95,0 @@ case win32:

src/unix.js

@@ -7,2 +7,4 @@ /**
 
+import { shellRequiredError } from "./constants.js";
+
 /**
@@ -12,6 +14,18 @@ * Escape a shell argument.
  * @param {string} arg The argument to escape.
+ * @param {string} shell The shell to escape the argument for.
  * @returns {string} The escaped argument.
  */
-export function escapeShellArg(arg) {
+export function escapeShellArg(arg, shell) {
+  if (shell === undefined) throw new TypeError(shellRequiredError);
+
   return arg.replace(/\u{0}/gu, "").replace(/'/g, `'\\''`);
 }
+
+/**
+ * Get the default shell for Unix systems.
+ *
+ * @returns {string} The default shell.
+ */
+export function getDefaultShell() {
+  return "/bin/sh";
+}

src/win.js

@@ -7,3 +7,3 @@ /**
 
-import { regexpPowerShell } from "./constants.js";
+import { regexpPowerShell, shellRequiredError } from "./constants.js";
 
@@ -38,6 +38,8 @@ /**
  * @param {string} arg The argument to escape.
- * @param {string} [shell] The shell to escape the argument for.
+ * @param {string} shell The shell to escape the argument for.
  * @returns {string} The escaped argument.
  */
 export function escapeShellArg(arg, shell) {
+  if (shell === undefined) throw new TypeError(shellRequiredError);
+
   if (regexpPowerShell.test(shell)) {
@@ -49,1 +51,12 @@ return escapeShellArgsForPowerShell(arg);
 }
+
+/**
+ * Get the default shell for Windows systems.
+ *
+ * @param {Object} env The environment variables.
+ * @param {string} env.ComSpec The ComSpec value.
+ * @returns {string} The default shell.
+ */
+export function getDefaultShell(env) {
+  return env.ComSpec;
+}

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

43333

increased by8.73%

Lines of code

605

increased by21.98%

Worsened metrics

Number of low supply chain risk alerts

8

increased byInfinity%

No dependency changes