`Git` class not secure
antonbaumann opened this issue · comments
static commitsAffectingFile(filePath: string): Promise<string[]> {
return new Promise((resolve, reject) => {
childProcess.exec(
`git log --follow ./${filePath} | grep commit`,
EXEC_OPTIONS,
(err, data) => {
if (!err)
resolve(
data.split('\n')
.map(line => line.replace('commit ', ''))
);
else
reject(err);
}
);
});
}
if you call wwt decl filePath foo
filePath
can be fully controlled by user
does commander
perform some sanity checks?
just found an example:
wwt line "Parser.ts; echo 'evil content' > evilFile.js; Parser.ts" 5
could be interesting:
https://github.com/desktop/dugite