Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Snyk "high security #765

Closed
Unitech opened this issue Aug 26, 2017 · 1 comment
Closed

Snyk "high security #765

Unitech opened this issue Aug 26, 2017 · 1 comment
Labels
exec Issues specific to the shell.exec() API security

Comments

@Unitech
Copy link

Unitech commented Aug 26, 2017

Node version (or tell us if you're using electron or some other framework):

ShellJS version (the most recent version/Github branch you see the bug on):

Operating system:

Description of the bug:

Example ShellJS command to reproduce the error:


      		
    

      
  





        


            

              
            

        

      


      
    








      

    



      

  
      



  

  @freitagbr





  


    

      

  

    

        
    
    

  


      
          
    
            Copy link

      
    

  


  

      

      

  
    Contributor


      

  


  

    

  





      


        


  
    

      
          
See #766.

      		
    

  





        


            

              
            

        

      


      

            
  

    
  
  

  

  



    












      

  
          

  


  

  

    
  


  

      

    @dependabot-preview
dependabot-preview
bot


    mentioned this issue
    
      Mar 19, 2018
    





  


  

      
   Closed

  







  




  

  

    
  

  


    

        @nfischer
nfischer




          added
      

  security


      

  exec

  Issues specific to the shell.exec() API

  labels


    Jun 26, 2019

  





  


  
    
  
  

    
  nfischer 

      added a commit
      that referenced
      this issue

    
      Jun 26, 2019
    
    

      


  

    

      


  

      
        @nfischer
  





      

        
          docs(exec): document security concerns
        

          
            
          

      


      

          

    
    
    

  

    


      


      

      


      
      

        
          e63899d
        
      

    

  

    

      
No change to logic.

This adds documentation about `shell.exec()`'s inherent vulnerability to
command injection and links to a more detailed security notice.

Issue #103, #143, #495, #765, #766, #810, #842, #938, #945

    




    

  




  

  

    
  


  

      

    @nfischer
nfischer



    mentioned this issue
    
      Jun 26, 2019
    





  


  

      
   Merged

  







  




  


  
    
  
  

    
  nfischer 

      added a commit
      that referenced
      this issue

    
      Jun 26, 2019
    
    

      


  

    

      


  

      
        @nfischer
  





      

        
          docs(exec): document security concerns (#950)
        

          
            
          

      


      

          

    
    
    

  

    


      


      

      


      
      

        
          68c3822
        
      

    

  

    

      
No change to logic.

This adds documentation about `shell.exec()`'s inherent vulnerability to
command injection and links to a more detailed security notice.

Issue #103, #143, #495, #765, #766, #810, #842, #938, #945

    




    

  




  

  

    
  

  


    

        @shelljs
shelljs




      locked as resolved and limited conversation to collaborators


    Jul 1, 2019

  














  
  

    

      

  





  




  
  

             

  
      Sign up for free
      to subscribe to this conversation on GitHub.
      Already have an account?
      Sign in.


  


  






  
                  




    

  


      
  

    Assignees
  



        

    No one assigned







      


  


  

    Labels
  



    

      

    exec

  Issues specific to the shell.exec() API
  

    security









      

  

    

        

    Projects
  


        




    None yet




  



      

  

    
  

    Milestone
  


      No milestone





    
      
          


  

    
      

        
    

    Development
  




              
No branches or pull requests







    
  




        
      

    

  
      

  

    

      3 participants
    

    

        
          @Unitech 
        
          @nfischer 
        
          @freitagbr