Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(core): don't allow arbitrary code execution when manipulating cache #9329

Merged
merged 1 commit into from Mar 18, 2022
Merged

fix(core): don't allow arbitrary code execution when manipulating cache #9329

merged 1 commit into from Mar 18, 2022

Commits on Mar 15, 2022

  1. fix(core): don't allow arbitrary code execution when manipulating cache 

    The Node documentation for `exec` states:

> Never pass unsanitized user input to this function. Any input containing shell metacharacters may be used to trigger arbitrary command execution.

The `folder` variable comes directly from the `NX_CACHE_DIRECTORY` environment variable (or from `nx.json`). Careful crafting of this variable can result in NX executing arbitrary commands.

This patch fixes this by using `execFile`, which does not spawn a shell.
    @sorin-davidoi @AgentEnder
    sorin-davidoi authored and AgentEnder committed Mar 15, 2022
    Copy the full SHA
    25b9f27 View commit details
    Browse the repository at this point in the history