`Git` class not secure

[Anton Baumann]

static commitsAffectingFile(filePath: string): Promise<string[]> {
        return new Promise((resolve, reject) => {
            childProcess.exec(
                `git log --follow ./${filePath} | grep commit`,
                EXEC_OPTIONS,
                (err, data) => {
                    if (!err)
                        resolve(
                            data.split('\n')
                                .map(line => line.replace('commit ', ''))
                        );
                    else
                        reject(err);
                }
            );
        });
    }

if you call wwt decl filePath foo
filePath can be fully controlled by user

does commander perform some sanity checks?

[Anton Baumann]

just found an example:
wwt line "Parser.ts; echo 'evil content' > evilFile.js; Parser.ts" 5

[Anton Baumann]

could be interesting:
https://github.com/desktop/dugite