-
Notifications
You must be signed in to change notification settings - Fork 1
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Sync with upstream #23
base: main
Are you sure you want to change the base?
Conversation
const binDev = | ||
process.platform === 'win32' ? join(process.cwd(), 'bin', 'dev.cmd') : join(process.cwd(), 'bin', 'dev.js') | ||
|
||
execSync(`${binDev} manifest`, {cwd: sfDir}) |
Check warning
Code scanning / CodeQL
Shell command built from environment values Medium test
absolute path
This shell command depends on an uncontrolled
absolute path
const silent = opts ? opts.silent : true | ||
return new Promise((resolve, reject) => { | ||
if (!silent) ux.log(chalk.dim(command)) | ||
const p = cpExec(command, opts ?? {}, (err, stdout, stderr) => { |
Check warning
Code scanning / CodeQL
Shell command built from environment values Medium
absolute path
|
||
* Revert "chore: add nyc" ([4150a7b](https://github.com/oclif/oclif/commit/4150a7bc05707a58942f51a8c94bf514ee5bbe6d)) | ||
- remove junit reporter from circle ([1927369](https://github.com/oclif/oclif/commit/1927369bcfd62d1ade4bbda7cd8ae32d1331331f)) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hello fellow developer! Looks like you committed a CircleCI secret.
Remember to keep secrets out of version control. If this was a production key, it needs to be rotated immediately.
Please reach out to security in the #fargo-security-alerts Slack channel.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This alert is a false positive, so you can ignore it.
opts: ExecOptions, | ||
): Promise<{code: number; stderr: string; stdout: string}> { | ||
return new Promise((resolve, reject) => { | ||
cpExec(command, opts, (error, stdout, stderr) => { |
Check warning
Code scanning / CodeQL
Shell command built from environment values Medium test
absolute path
This shell command depends on an uncontrolled
absolute path
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI about 1 month ago
To fix the problem, we should avoid constructing the shell command as a single string and instead use the execFile
or execFileSync
method from the child_process
module. These methods allow us to pass the command and its arguments separately, which prevents the shell from interpreting special characters in the arguments.
- Modify the
exec
function intest/integration/util.ts
to useexecFile
instead ofexec
. - Update the calls to the
exec
function intest/integration/cli.test.ts
to pass the command and arguments separately.
-
Copy modified line R1 -
Copy modified line R5 -
Copy modified line R9
@@ -1,2 +1,2 @@ | ||
import {ExecOptions, exec as cpExec} from 'node:child_process' | ||
import {ExecOptions, execFile as cpExecFile} from 'node:child_process' | ||
|
||
@@ -4,2 +4,3 @@ | ||
command: string, | ||
args: string[], | ||
opts: ExecOptions, | ||
@@ -7,3 +8,3 @@ | ||
return new Promise((resolve, reject) => { | ||
cpExec(command, opts, (error, stdout, stderr) => { | ||
cpExecFile(command, args, opts, (error, stdout, stderr) => { | ||
if (error) { |
-
Copy modified lines R54-R55 -
Copy modified line R63
@@ -53,3 +53,4 @@ | ||
const genResult = await exec( | ||
`${executable} generate ${cliName} --yes --module-type ${MODULE_TYPE} --package-manager ${PACKAGE_MANAGER}`, | ||
executable, | ||
['generate', cliName, '--yes', '--module-type', MODULE_TYPE, '--package-manager', PACKAGE_MANAGER], | ||
{cwd: tmpDir}, | ||
@@ -61,3 +62,3 @@ | ||
|
||
const result = await exec(`${cliBinRun} hello world`, {cwd: cliDir}) | ||
const result = await exec(cliBinRun, ['hello', 'world'], {cwd: cliDir}) | ||
expect(result.code).to.equal(0) |
[pkg, sha] = await findDistFileSha(cwd, 'macos', f => f.endsWith('x64.pkg')) | ||
await exec(`sudo installer -pkg ${path.join(cwd, 'dist', 'macos', pkg)} -target /`) | ||
;[pkg, sha] = await findDistFileSha(cwd, 'macos', (f) => f.endsWith('x64.pkg')) | ||
exec(`sudo installer -pkg ${path.join(cwd, 'dist', 'macos', pkg)} -target /`) |
Check warning
Code scanning / CodeQL
Shell command built from environment values Medium test
absolute path
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI about 1 month ago
To fix the problem, we should avoid constructing the shell command as a single string and instead use a method that allows passing arguments separately. The execFileSync
method from the child_process
module is suitable for this purpose. This method takes the command and its arguments as separate parameters, which prevents the shell from misinterpreting the command.
- Import the
execFileSync
method from thechild_process
module. - Replace the
exec
call withexecFileSync
, passing the command and its arguments separately.
-
Copy modified line R9 -
Copy modified line R51
@@ -8,2 +8,3 @@ | ||
import {exec} from 'shelljs' | ||
import {execFileSync} from 'child_process' | ||
|
||
@@ -49,3 +50,3 @@ | ||
;[pkg, sha] = await findDistFileSha(cwd, 'macos', (f) => f.endsWith('x64.pkg')) | ||
exec(`sudo installer -pkg ${path.join(cwd, 'dist', 'macos', pkg)} -target /`) | ||
execFileSync('sudo', ['installer', '-pkg', path.join(cwd, 'dist', 'macos', pkg), '-target', '/']) | ||
expect(exec('oclif --version').stdout).to.contain(`oclif/${pjson.version}`) |
const debUrl = `https://${developerSalesforceCom}/${basePrefix}/versions/${pjson.version}/${sha}/apt/oclif_${pjson.version.split('-')[0]}.${sha}-1_amd64.deb` | ||
console.log('downloading .deb from', debUrl) | ||
// download the deb | ||
await exec(`curl -sL ${debUrl} -o ${root}/oclif.deb`) |
Check warning
Code scanning / CodeQL
Shell command built from environment values Medium test
absolute path
// download the deb | ||
await exec(`curl -sL ${debUrl} -o ${root}/oclif.deb`) | ||
// install the deb | ||
await exec(`sudo dpkg -i ${root}/oclif.deb`) |
Check warning
Code scanning / CodeQL
Shell command built from environment values Medium test
absolute path
Bumps [eslint-config-oclif](https://github.com/oclif/eslint-config-oclif) from 5.2.0 to 5.2.1. - [Release notes](https://github.com/oclif/eslint-config-oclif/releases) - [Changelog](https://github.com/oclif/eslint-config-oclif/blob/main/CHANGELOG.md) - [Commits](oclif/eslint-config-oclif@5.2.0...5.2.1) --- updated-dependencies: - dependency-name: eslint-config-oclif dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]>
Bumps [@oclif/plugin-not-found](https://github.com/oclif/plugin-not-found) from 3.2.14 to 3.2.15. - [Release notes](https://github.com/oclif/plugin-not-found/releases) - [Changelog](https://github.com/oclif/plugin-not-found/blob/main/CHANGELOG.md) - [Commits](oclif/plugin-not-found@3.2.14...3.2.15) --- updated-dependencies: - dependency-name: "@oclif/plugin-not-found" dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]>
Bumps [@oclif/core](https://github.com/oclif/core) from 4.0.16 to 4.0.17. - [Release notes](https://github.com/oclif/core/releases) - [Changelog](https://github.com/oclif/core/blob/main/CHANGELOG.md) - [Commits](oclif/core@4.0.16...4.0.17) --- updated-dependencies: - dependency-name: "@oclif/core" dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]>
Bumps [@aws-sdk/client-cloudfront](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-cloudfront) from 3.623.0 to 3.624.0. - [Release notes](https://github.com/aws/aws-sdk-js-v3/releases) - [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-cloudfront/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.624.0/clients/client-cloudfront) --- updated-dependencies: - dependency-name: "@aws-sdk/client-cloudfront" dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>
…sdk-client-cloudfront-3.624.0 fix(deps): bump @aws-sdk/client-cloudfront from 3.623.0 to 3.624.0
…f-core-4.0.17 fix(deps): bump @oclif/core from 4.0.16 to 4.0.17
…f-plugin-not-found-3.2.15 fix(deps): bump @oclif/plugin-not-found from 3.2.14 to 3.2.15
Bumps [@inquirer/confirm](https://github.com/SBoudrias/Inquirer.js) from 3.1.17 to 3.1.22. - [Release notes](https://github.com/SBoudrias/Inquirer.js/releases) - [Commits](https://github.com/SBoudrias/Inquirer.js/compare/@inquirer/[email protected]...@inquirer/[email protected]) --- updated-dependencies: - dependency-name: "@inquirer/confirm" dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]>
…irer-confirm-3.1.22 fix(deps): bump @inquirer/confirm from 3.1.17 to 3.1.22
…nt-config-oclif-5.2.1 chore(dev-deps): bump eslint-config-oclif from 5.2.0 to 5.2.1
Bumps [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) from 3.614.0 to 3.633.0. - [Release notes](https://github.com/aws/aws-sdk-js-v3/releases) - [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.633.0/clients/client-s3) --- updated-dependencies: - dependency-name: "@aws-sdk/client-s3" dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>
Bumps [eslint-config-oclif-typescript](https://github.com/oclif/eslint-config-oclif-typescript) from 3.1.8 to 3.1.9. - [Release notes](https://github.com/oclif/eslint-config-oclif-typescript/releases) - [Changelog](https://github.com/oclif/eslint-config-oclif-typescript/blob/main/CHANGELOG.md) - [Commits](oclif/eslint-config-oclif-typescript@3.1.8...3.1.9) --- updated-dependencies: - dependency-name: eslint-config-oclif-typescript dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]>
Bumps [@oclif/plugin-warn-if-update-available](https://github.com/oclif/plugin-warn-if-update-available) from 3.0.19 to 3.1.11. - [Release notes](https://github.com/oclif/plugin-warn-if-update-available/releases) - [Changelog](https://github.com/oclif/plugin-warn-if-update-available/blob/main/CHANGELOG.md) - [Commits](oclif/plugin-warn-if-update-available@3.0.19...3.1.11) --- updated-dependencies: - dependency-name: "@oclif/plugin-warn-if-update-available" dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>
Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 18.19.42 to 18.19.44. - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) --- updated-dependencies: - dependency-name: "@types/node" dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]>
…s-node-18.19.44 chore(dev-deps): bump @types/node from 18.19.42 to 18.19.44
…f-plugin-warn-if-update-available-3.1.11 fix(deps): bump @oclif/plugin-warn-if-update-available from 3.0.19 to 3.1.11
Bumps [@oclif/plugin-help](https://github.com/oclif/plugin-help) from 6.2.7 to 6.2.8. - [Release notes](https://github.com/oclif/plugin-help/releases) - [Changelog](https://github.com/oclif/plugin-help/blob/main/CHANGELOG.md) - [Commits](oclif/plugin-help@6.2.7...6.2.8) --- updated-dependencies: - dependency-name: "@oclif/plugin-help" dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]>
…s-node-18.19.67 chore(dev-deps): bump @types/node from 18.19.64 to 18.19.67
…s-mocha-10.0.10 chore(dev-deps): bump @types/mocha from 10.0.9 to 10.0.10
…f-test-4.1.2 chore(dev-deps): bump @oclif/test from 4.1.0 to 4.1.2
* fix(deps): bump @aws-sdk/client-s3 from 3.701.0 to 3.705.0 Bumps [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) from 3.701.0 to 3.705.0. - [Release notes](https://github.com/aws/aws-sdk-js-v3/releases) - [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.705.0/clients/client-s3) --- updated-dependencies: - dependency-name: "@aws-sdk/client-s3" dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> * chore: linting error --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Mike Donnalley <[email protected]>
…clif#1626) Bumps [@aws-sdk/client-cloudfront](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-cloudfront) from 3.687.0 to 3.699.0. - [Release notes](https://github.com/aws/aws-sdk-js-v3/releases) - [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-cloudfront/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.699.0/clients/client-cloudfront) --- updated-dependencies: - dependency-name: "@aws-sdk/client-cloudfront" dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [debug](https://github.com/debug-js/debug) from 4.3.7 to 4.4.0. - [Release notes](https://github.com/debug-js/debug/releases) - [Commits](debug-js/debug@4.3.7...4.4.0) --- updated-dependencies: - dependency-name: debug dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [prettier](https://github.com/prettier/prettier) from 3.3.3 to 3.4.2. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.3.3...3.4.2) --- updated-dependencies: - dependency-name: prettier dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [@oclif/core](https://github.com/oclif/core) from 4.0.32 to 4.0.36. - [Release notes](https://github.com/oclif/core/releases) - [Changelog](https://github.com/oclif/core/blob/main/CHANGELOG.md) - [Commits](oclif/core@4.0.32...4.0.36) --- updated-dependencies: - dependency-name: "@oclif/core" dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) from 3.705.0 to 3.712.0. - [Release notes](https://github.com/aws/aws-sdk-js-v3/releases) - [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.712.0/clients/client-s3) --- updated-dependencies: - dependency-name: "@aws-sdk/client-s3" dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>
Bumps [@oclif/plugin-not-found](https://github.com/oclif/plugin-not-found) from 3.2.25 to 3.2.30. - [Release notes](https://github.com/oclif/plugin-not-found/releases) - [Changelog](https://github.com/oclif/plugin-not-found/blob/main/CHANGELOG.md) - [Commits](oclif/plugin-not-found@3.2.25...3.2.30) --- updated-dependencies: - dependency-name: "@oclif/plugin-not-found" dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]>
Bumps [lint-staged](https://github.com/lint-staged/lint-staged) from 15.2.10 to 15.2.11. - [Release notes](https://github.com/lint-staged/lint-staged/releases) - [Changelog](https://github.com/lint-staged/lint-staged/blob/master/CHANGELOG.md) - [Commits](lint-staged/lint-staged@v15.2.10...v15.2.11) --- updated-dependencies: - dependency-name: lint-staged dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]>
…-staged-15.2.11 chore(dev-deps): bump lint-staged from 15.2.10 to 15.2.11
Bumps [@oclif/plugin-legacy](https://github.com/oclif/plugin-legacy) from 2.0.18 to 2.0.19. - [Release notes](https://github.com/oclif/plugin-legacy/releases) - [Changelog](https://github.com/oclif/plugin-legacy/blob/main/CHANGELOG.md) - [Commits](oclif/plugin-legacy@2.0.18...2.0.19) --- updated-dependencies: - dependency-name: "@oclif/plugin-legacy" dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]>
…f-plugin-not-found-3.2.30 fix(deps): bump @oclif/plugin-not-found from 3.2.25 to 3.2.30
Bumps [@oclif/core](https://github.com/oclif/core) from 4.0.36 to 4.0.37. - [Release notes](https://github.com/oclif/core/releases) - [Changelog](https://github.com/oclif/core/blob/main/CHANGELOG.md) - [Commits](oclif/core@4.0.36...4.0.37) --- updated-dependencies: - dependency-name: "@oclif/core" dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]>
…f-core-4.0.37 fix(deps): bump @oclif/core from 4.0.36 to 4.0.37
…f-plugin-legacy-2.0.19 chore(dev-deps): bump @oclif/plugin-legacy from 2.0.18 to 2.0.19
…sdk-client-s3-3.712.0 fix(deps): bump @aws-sdk/client-s3 from 3.705.0 to 3.712.0
feat: allow pack:tarball on windows (oclif#1638)
This is an automated PR to bring this repo up-to-date with oclif/oclif.