simple-git - npm Package Compare versions

Comparing version 0.17.0 to 1.0.0

package.json

 {
   "name": "simple-git",
   "description": "Simple GIT interface for node.js",
-  "version": "0.17.0",
+  "version": "1.0.0",
   "author": "Steve King <[e-mail]>",
@@ -6,0 +6,0 @@ "contributors": [

readme.md

@@ -76,3 +76,3 @@ # Simple Git
 `.listRemote([args], handlerFn)` lists remote repositories - there are so many optional arguments in the underlying
-`git ls-remote` call, just supply any you want to use as the optional `args` string.
+`git ls-remote` call, just supply any you want to use as the optional `args` array of strings eg: `git.listRemote(['--heads', '--tags'], console.log.bind(console))`. 
 
@@ -85,2 +85,7 @@ `outputHandler(handlerFn)` attaches a handler that will be called with the name of the command being run and the
 
+# Release History
+
+Bumped to a new major revision in the 1.x branch, now uses `ChildProcess.spawn` in place of `ChildProcess.exec` to
+add escaping to the arguments passed to each of the tasks.
+
 # Deprecated APIs
@@ -87,0 +92,0 @@

src/git.js

 (function () {
 
     var ChildProcess = require('child_process');
-    var merge = require('util').format;
+    var Buffer = require('buffer').Buffer;
+    var warn = function (message) {
+        if (!/prod/.test(process.env.NODE_ENV)) {
+            console.warn(message);
+        }
+    };
 
@@ -77,3 +82,3 @@ /**
     Git.prototype.status = function (then) {
-        return this._run(['status --porcelain'], function (err, data) {
+        return this._run('status --porcelain', function (err, data) {
             then && then(err, !err && this._parseStatus(data));
@@ -91,3 +96,3 @@ });
     Git.prototype.clone = function (repoPath, localPath, then) {
-        return this._run(['clone %s %s', repoPath, localPath], function (err) {
+        return this._run(['clone', repoPath, localPath], function (err) {
             then && then(err);
@@ -116,3 +121,3 @@ });
     Git.prototype.add = function (files, then) {
-        return this._run(['add "%s"', [].concat(files).join('" "')], function (err, data) {
+        return this._run(['add'].concat(files), function (err, data) {
             then && then(err);
@@ -139,3 +144,3 @@ });
 
-        return this._run(['commit -m "%s" %s', message.replace(/"/g, '\\"'), files], function (err, data) {
+        return this._run(['commit', '-m', message].concat(files), function (err, data) {
             then && then(err, !err && git._parseCommit(data));
@@ -152,5 +157,5 @@ });
     Git.prototype.pull = function (remote, branch, then) {
-        var command = "pull";
+        var command = ["pull"];
         if (typeof remote === 'string' && typeof branch === 'string') {
-            command = ['pull "%s" "%s"', remote, branch];
+            command.push(remote, branch);
         }
@@ -178,5 +183,5 @@ if (typeof arguments[arguments.length - 1] === 'function') {
     Git.prototype.fetch = function (remote, branch, then) {
-        var command = "fetch";
+        var command = ["fetch"];
         if (typeof remote === 'string' && typeof branch === 'string') {
-            command = ['fetch "%s" "%s"', remote, branch];
+            command.push(remote, branch);
         }
@@ -198,3 +203,3 @@ if (typeof arguments[arguments.length - 1] === 'function') {
     Git.prototype.tags = function (then) {
-        return this._run('tag -l', function (err, data) {
+        return this._run(['tag', '-l'], function (err, data) {
             then && then(err, !err && this._parseListTags(data));
@@ -211,3 +216,3 @@ });
     Git.prototype.checkout = function (what, then) {
-        return this._run(['checkout "%s"', what], function (err, data) {
+        return this._run(['checkout', what], function (err, data) {
             then && then(err, !err && this._parseCheckout(data));
@@ -225,3 +230,3 @@ });
     Git.prototype.checkoutBranch = function (branchName, startPoint, then) {
-        return this._run(['checkout -b "%s" "%s"', branchName, startPoint], function (err, data) {
+        return this._run(['checkout', '-b', branchName, startPoint], function (err, data) {
             then && then(err, !err && this._parseCheckout(data));
@@ -238,3 +243,3 @@ });
     Git.prototype.checkoutLocalBranch = function (branchName, then) {
-        return this._run(['checkout -b "%s"', branchName], function (err, data) {
+        return this._run(['checkout', '-b', branchName], function (err, data) {
             then && then(err, !err && this._parseCheckout(data));
@@ -252,3 +257,3 @@ });
     Git.prototype.submoduleAdd = function (repo, path, then) {
-        return this._run(['submodule add "%s" "%s"', repo, path], function (err) {
+        return this._run(['submodule', 'add', repo, path], function (err) {
             then && then(err);
@@ -261,3 +266,3 @@ });
      *
-     * @param {String} [args]
+     * @param {String[]} [args]
      * @param {Function} [then]
@@ -268,5 +273,10 @@ */
             then = args;
-            args = '';
+            args = [];
         }
-        return this._run('ls-remote ' + args, function (err, data) {
+
+        if (typeof args === 'string') {
+            warn('Git#listRemote: args should be supplied as an array of individual arguments');
+        }
+
+        return this._run(['ls-remote'].concat(args), function (err, data) {
             then && then(err, data);
@@ -407,3 +417,3 @@ });
     Git.prototype.log = function (options, then) {
-        var command = "log --pretty=format:'%H;%ai;%s%d;%aN;%ae'";
+        var command = ["log", "--pretty=format:'%H;%ai;%s%d;%aN;%ae'"];
         var opt = {};
@@ -421,3 +431,3 @@
         else if (typeof args[0] === "string" || typeof args[1] === "string") {
-            console.warn("Git#log: supplying to or from as strings is now deprecated, switch to an options configuration object");
+            warn("Git#log: supplying to or from as strings is now deprecated, switch to an options configuration object");
             opt = {
@@ -430,7 +440,7 @@ from: args[0],
         if (opt.from && opt.to) {
-            command += ' ' + opt.from + "..." + opt.to;
+            command.push(opt.from + "..." + opt.to);
         }
 
         if (opt.file) {
-            command += " --follow " + options.file;
+            command.push("--follow", options.file);
         }
@@ -444,3 +454,3 @@
     Git.prototype._rm = function (files, options, then) {
-        return this._run(['rm %s "%s"', options, [].concat(files).join('" "')], function (err) {
+        return this._run(['rm', options, [].concat(files)], function (err) {
             then && then(err);
@@ -518,2 +528,3 @@ });
         var modified = [];
+        var created = [];
 
@@ -535,2 +546,5 @@ var whitespace = /\s+/;
                     break;
+                case "AM":
+                    created.push(line.join());
+                    break;
             }
@@ -542,3 +556,4 @@ }
             deleted: deleted,
-            modified: modified
+            modified: modified,
+            created: created
         };
@@ -602,7 +617,6 @@ };
     Git.prototype._run = function (command, then) {
-        if (Array.isArray(command)) {
-            command = merge.apply(merge, command);
+        if (typeof command === "string") {
+            command = command.split(" ");
         }
-
-        this._runCache.push([this._command + ' ' + command, then]);
+        this._runCache.push([command, then]);
         this._schedule();
@@ -619,22 +633,32 @@
 
-            this._childProcess = ChildProcess.exec(
-                command,
-                {cwd: this._baseDir},
-                function (err, stdout, stderr) {
-                    delete this._childProcess;
+            var stdOut = [];
+            var stdErr = [];
+            var spawned = ChildProcess.spawn(this._command, command.slice(0), {
+                cwd: this._baseDir
+            });
 
-                    if (err) {
-                        console.error(stderr);
-                        this._runCache = [];
-                        then.call(this, err, null);
-                    }
-                    else {
-                        then.call(this, null, stdout);
-                    }
+            spawned.stdout.on('data', function (buffer) { stdOut.push(buffer); });
+            spawned.stderr.on('data', function (buffer) { stdErr.push(buffer); });
 
-                    process.nextTick(this._schedule.bind(this));
-                }.bind(this));
+            spawned.on('close', function (exitCode, exitSignal) {
+                delete this._childProcess;
 
+                if (exitCode && stdErr.length) {
+                    stdErr = Buffer.concat(stdErr).toString('utf-8');
+
+                    console.error(stdErr);
+                    this._runCache = [];
+                    then.call(this, stdErr, null);
+                }
+                else {
+                    then.call(this, null, stdOut.toString('utf-8'));
+                }
+
+                process.nextTick(this._schedule.bind(this));
+            }.bind(this));
+
+            this._childProcess = spawned;
+
             if (this._outputHandler) {
-                this._outputHandler(command.split(' ')[0],
+                this._outputHandler(command[0],
                     this._childProcess.stdout,
@@ -641,0 +665,0 @@ this._childProcess.stderr);

New alerts

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Fixed alerts

No v1

Quality

Package is not semver >=1. This means it is not stable and does not support ^ ranges.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

27843

increased by5.08%

Number of package files

6

increased by20%

Lines of code

601

increased by5.25%

Number of low quality alerts

1

decreased by-50%

Number of lines in readme file

153

increased by3.38%

Worsened metrics

Number of low supply chain risk alerts

2

increased by100%

No dependency changes