Skip to content

Commit

Permalink
Oops
Browse files Browse the repository at this point in the history
  • Loading branch information
tiagobento committed Oct 1, 2024
1 parent 73d8570 commit 65acbff
Showing 1 changed file with 7 additions and 6 deletions.
13 changes: 7 additions & 6 deletions packages/maven-base/index.js
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@
* under the License.
*/

const cp = require("child_process");
const fs = require("fs");
const path = require("path");

Expand All @@ -36,7 +37,7 @@ const DEFAULT_MAVEN_CONFIG = `
`.trim();

const DEFAULT_LOCAL_REPO = String(
fs.execSync(`mvn help:evaluate -Dexpression=settings.localRepository -q -DforceStdout -f ${EMPTY_POM_XML_PATH}`, {
cp.execSync(`mvn help:evaluate -Dexpression=settings.localRepository -q -DforceStdout -f ${EMPTY_POM_XML_PATH}`, {

Check warning

Code scanning / CodeQL

Shell command built from environment values Medium

This shell command depends on an uncontrolled
absolute path
.
stdio: "pipe",
encoding: "utf-8",
})
Expand Down Expand Up @@ -66,7 +67,7 @@ module.exports = {
installMvnw: () => {
console.info(`[maven-base] Installing mvnw...`);
console.time(`[maven-base] Installing mvnw...`);
fs.execSync(`mvn -e org.apache.maven.plugins:maven-wrapper-plugin:${MVNW_VERSION}:wrapper ${BOOTSTRAP_CLI_ARGS}`, {
cp.execSync(`mvn -e org.apache.maven.plugins:maven-wrapper-plugin:${MVNW_VERSION}:wrapper ${BOOTSTRAP_CLI_ARGS}`, {

Check warning

Code scanning / CodeQL

Shell command built from environment values Medium

This shell command depends on an uncontrolled
absolute path
.
stdio: "inherit",
});
console.timeEnd(`[maven-base] Installing mvnw...`);
Expand Down Expand Up @@ -97,7 +98,7 @@ module.exports = {
fs.mkdirSync(resolvedTmpM2Dir, { recursive: true });

// head
fs.execSync(`cp -nal ${DEFAULT_LOCAL_REPO}/* ${resolvedTmpM2Dir}`, { stdio: "inherit" });
cp.execSync(`cp -nal ${DEFAULT_LOCAL_REPO}/* ${resolvedTmpM2Dir}`, { stdio: "inherit" });

Check warning

Code scanning / CodeQL

Unsafe shell command constructed from library input Medium

This string concatenation which depends on
library input
is later used in a
shell command
.

Check warning

Code scanning / CodeQL

Shell command built from environment values Medium

This shell command depends on an uncontrolled
absolute path
.

const cwd = path.resolve(".", relativePackagePath);
const packageName = require(path.resolve(cwd, "package.json")).name;
Expand All @@ -106,7 +107,7 @@ module.exports = {
// tail
for (const t of tail) {
if (fs.existsSync(path.resolve(t))) {
fs.execSync(`cp -al ${path.resolve(t)}/* ${resolvedTmpM2Dir}`, { stdio: "inherit" });
cp.execSync(`cp -al ${path.resolve(t)}/* ${resolvedTmpM2Dir}`, { stdio: "inherit" });

Check warning

Code scanning / CodeQL

Unsafe shell command constructed from library input Medium

This string concatenation which depends on
library input
is later used in a
shell command
.

Check warning

Code scanning / CodeQL

Shell command built from environment values Medium

This shell command depends on an uncontrolled
absolute path
.
This shell command depends on an uncontrolled
absolute path
.
This shell command depends on an uncontrolled
absolute path
.
This shell command depends on an uncontrolled
file name
.
This shell command depends on an uncontrolled
absolute path
.
}
}
},
Expand All @@ -128,9 +129,9 @@ module.exports = {
const cmd = `mvn versions:set-property -Dproperty=${key} -DnewVersion=${value} -DgenerateBackupPoms=false ${BOOTSTRAP_CLI_ARGS}`;

Check warning

Code scanning / CodeQL

Unsafe shell command constructed from library input Medium

This string concatenation which depends on
library input
is later used in a
shell command
.
This string concatenation which depends on
library input
is later used in a
shell command
.

if (process.platform === "win32") {
fs.execSync(cmd.replaceAll(" -", " `-"), { stdio: "inherit", shell: "powershell.exe" });
cp.execSync(cmd.replaceAll(" -", " `-"), { stdio: "inherit", shell: "powershell.exe" });

Check warning

Code scanning / CodeQL

Shell command built from environment values Medium

This shell command depends on an uncontrolled
absolute path
.
} else {
fs.execSync(cmd, { stdio: "inherit" });
cp.execSync(cmd, { stdio: "inherit" });

Check warning

Code scanning / CodeQL

Shell command built from environment values Medium

This shell command depends on an uncontrolled
absolute path
.
}

console.timeEnd(`[maven-base] Setting property '${key}' with value '${value}'...`);
Expand Down

0 comments on commit 65acbff

Please sign in to comment.