Fix code scanning alert no. 1: Shell command built from environment values #11

Merged

lucmsilva651 merged 1 commit from autofix/alert-1-ce74013bf2 into main

2024-09-28 21:44:00 +00:00

lucmsilva651 commented

2024-09-28 21:42:40 +00:00

(Migrated from github.com)

Fixes https://github.com/lucmsilva651/lynx/security/code-scanning/1

To fix the problem, we should avoid constructing the shell command as a single string. Instead, we should use the execFile function from the child_process module, which allows us to pass the command and its arguments separately. This approach prevents the shell from interpreting special characters in the arguments.

Replace the exec function with execFile.
Construct the command arguments as an array and pass them to execFile.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

Fixes [https://github.com/lucmsilva651/lynx/security/code-scanning/1](https://github.com/lucmsilva651/lynx/security/code-scanning/1) To fix the problem, we should avoid constructing the shell command as a single string. Instead, we should use the `execFile` function from the `child_process` module, which allows us to pass the command and its arguments separately. This approach prevents the shell from interpreting special characters in the arguments. 1. Replace the `exec` function with `execFile`. 2. Construct the command arguments as an array and pass them to `execFile`. _Suggested fixes powered by Copilot Autofix. Review carefully before merging._