Snyk vulnerability DB reporting command injection vulnerability in ShellJS

[webstackdev]

Node version (or tell us if you're using electron or some other framework):

8.0.0

ShellJS version (the most recent version/Github branch you see the bug on):

0.7.8

Operating system:

Linux

Description of the bug:

Snyk reports high severity vulnerability in shelljs

Example ShellJS command to reproduce the error:

In a repository with ShellJS as a dependency:

username> snyk test

✗ High severity vulnerability found on shelljs@0.7.8
- desc: Command Injection
- info: https://snyk.io/vuln/npm:shelljs:20140723
- from: xxx@0.1.0 > shelljs@0.7.8
Fix: None available. Consider removing this dependency.

This is related to issues 143, 495, and PR 524. Wasn't sure if the project was aware that ShellJS will break builds using vulnerability scanning in their CI workflow.

[nfischer]

Dupe of #766.

Known issue. If you don't use shell.exec(), you have no problem. If you do use shell.exec(), don't pass untrusted user input (or other external values) to the function--string literals are of course the safest option.

As you pointed out, I've been working on this for a bit (#524 is a demo). The goal is to provide a better alternative to exec and then to deprecate it (not sure if this satisfies your CI case, but I'd rather not remove it immediately to reduce migration burden).

[webstackdev]

Thank you for the response, and thanks for your work on the library. Sorry I missed the dup - I searched but didn't see it.