github-featured / nrwl--nx

发布

0 发布 1,252 Git 标签

RSS 订阅源
  • 22.4.5 43a34d0b95
    比较

    fix(core): prevent command injection in getNpmPackageVersion (#34309)

    frostbyte_neo 发布于 2026-02-03 21:37:59 +00:00

    Current Behavior

    The getNpmPackageVersion function in
    packages/workspace/src/generators/utils/get-npm-package-version.ts
    uses execSync with direct string interpolation of the packageName
    parameter. When a user runs create-nx-workspace with a custom
    --preset value that doesn't match a known preset, the value flows
    unsanitized into a shell command:

    execSync(`npm view ${packageName}... version --json`)

    This allows arbitrary command execution via shell metacharacters (e.g.,
    --preset='pkg$(malicious command)').

    Expected Behavior

    User-supplied package names are validated against a strict npm package
    name regex before being passed to any shell command. The function now
    uses execFileSync with an args array instead of execSync with string
    interpolation, providing defense in depth:

    1. Input validation — rejects anything that isn't a valid npm
      package name
    2. Safe execution — arguments are passed as an array so Node.js
      handles escaping, rather than concatenating into a raw shell string

    (cherry picked from commit 79d878f240)

    下载附件