feat apilinks.json generator #153
Conversation
Closes #152 Signed-off-by: flakey5 <[email protected]>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| */ | ||
| export function getGitRepository(directory) { | ||
| try { | ||
| const trackingRemote = execSync(`cd ${directory} && git remote`); |
Check warning
Code scanning / CodeQL
Unsafe shell command constructed from library input Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 1 day ago
To fix the problem, we should avoid using execSync with unsanitized input. Instead, we can use execFileSync from the child_process module, which allows us to pass arguments as an array, avoiding shell interpretation. This change ensures that the input is treated as a literal string and not as a part of the shell command.
- Replace
execSyncwithexecFileSyncin thegetGitRepositoryandgetGitTagfunctions. - Modify the commands to use
execFileSyncwith arguments passed as an array.
| @@ -2,3 +2,3 @@ | ||
|
|
||
| import { execSync } from 'child_process'; | ||
| import { execFileSync } from 'child_process'; | ||
|
|
||
| @@ -14,6 +14,4 @@ | ||
| try { | ||
| const trackingRemote = execSync(`cd ${directory} && git remote`); | ||
| const remoteUrl = execSync( | ||
| `cd ${directory} && git remote get-url ${trackingRemote}` | ||
| ); | ||
| const trackingRemote = execFileSync('git', ['-C', directory, 'remote']).toString().trim(); | ||
| const remoteUrl = execFileSync('git', ['-C', directory, 'remote', 'get-url', trackingRemote]).toString().trim(); | ||
|
|
||
| @@ -40,7 +38,5 @@ | ||
| const hash = | ||
| execSync(`cd ${directory} && git log -1 --pretty=%H`) || 'main'; | ||
| execFileSync('git', ['-C', directory, 'log', '-1', '--pretty=%H']).toString().trim() || 'main'; | ||
| const tag = | ||
| execSync(`cd ${directory} && git describe --contains ${hash}`).split( | ||
| '\n' | ||
| )[0] || hash; | ||
| execFileSync('git', ['-C', directory, 'describe', '--contains', hash]).toString().split('\n')[0] || hash; | ||
|
|
| try { | ||
| const trackingRemote = execSync(`cd ${directory} && git remote`); | ||
| const remoteUrl = execSync( | ||
| `cd ${directory} && git remote get-url ${trackingRemote}` |
Check warning
Code scanning / CodeQL
Unsafe shell command constructed from library input Medium
| export function getGitTag(directory) { | ||
| try { | ||
| const hash = | ||
| execSync(`cd ${directory} && git log -1 --pretty=%H`) || 'main'; |
Check warning
Code scanning / CodeQL
Unsafe shell command constructed from library input Medium
| const hash = | ||
| execSync(`cd ${directory} && git log -1 --pretty=%H`) || 'main'; | ||
| const tag = | ||
| execSync(`cd ${directory} && git describe --contains ${hash}`).split( |
Check warning
Code scanning / CodeQL
Unsafe shell command constructed from library input Medium
| @@ -0,0 +1,52 @@ | |||
| 'use strict'; | |||
|
|
|||
| import { execSync } from 'child_process'; | |||
There was a problem hiding this comment.
| import { execSync } from 'child_process'; | |
| import { execSync } from 'node:child_process'; |
| @@ -1,10 +1,12 @@ | |||
| // @ts-check | |||
There was a problem hiding this comment.
| // @ts-check |
use actualy didn't use type-checking
Closes #152
Opening this as a draft currently to get feedback on the approach since it's a bit non-trivial relative to the other generators. The
apilinks.jsonfile maps things exported by modules to their source locations on Github.Example:
{ "SomeClass.prototype.var": "github.com/nodejs/node/tree/<hash>/lib/file.js#L100" }This means we need to parse the module's javascript source in addition to its markdown.
What the current approach does is doing:
acornis used for parsing the source filessource_linkmetadata in the docsast-jsgeneratorapi-linksgenerator is based off of theast-jsresultWith the current approach, the generator is almost there. Some todos remain though: