Merge pull request #164 from codecov/sanitize-gcov-options

[CE-1263] Sanitize gcov-args
codecov · Jan 16, 2020 · f429409 · f429409
2 parents 9bde072 + 2f4eff9
commit f429409
Show file tree

Hide file tree

Showing 3 changed files with 10 additions and 3 deletions.
diff --git a/lib/codecov.js b/lib/codecov.js
@@ -5,6 +5,7 @@ var urlgrey = require('urlgrey')
 var jsYaml = require('js-yaml')
 var walk = require('ignore-walk')
 var execSync = require('child_process').execSync
+var validator = require('validator')
 
 var detectProvider = require('./detect')
 
@@ -397,9 +398,9 @@ var upload = function(args, on_success, on_failure) {
           " -type f -name '*.gcno' " +
           gcg +
           ' -exec ' +
-          (args.options['gcov-exec'] || 'gcov') +
+          (validator.escape(args.options['gcov-exec']) || 'gcov') +
           ' ' +
-          (args.options['gcov-args'] || '') +
+          (validator.escape(args.options['gcov-args']) || '') +
           ' {} +'
       } else {
         // @TODO support for root

diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -35,7 +35,8 @@
     "ignore-walk": "^3.0.1",
     "js-yaml": "^3.13.1",
     "teeny-request": "^3.11.3",
-    "urlgrey": "^0.4.4"
+    "urlgrey": "^0.4.4",
+    "validator": "^12.1.0"
   },
   "devDependencies": {
     "eslint": "^5.16.0",