70bc47eadc
Command injection (real fix): - which.ts: switch to array-args execa, remove shell:true - execFileNoThrowPortable/execSyncWrapper/imagePaste/execFileNoThrow: security comments Log injection: - handlers/mcp.tsx: security comments (secrets already redacted) ReDoS: - debugFilter.ts: split regex, add input length guard Sanitization bypass: - stripHtml.ts: loop-based script/style removal - claudemd.ts: loop-based HTML comment stripping - sedEditParser.ts: single-pass char scan replaces chained replaces - bingAdapter.ts: URL.hostname comparison instead of string includes Tests: 3068 pass, 0 fail
42 lines
1.4 KiB
TypeScript
42 lines
1.4 KiB
TypeScript
import {
|
|
type ExecSyncOptions,
|
|
type ExecSyncOptionsWithBufferEncoding,
|
|
type ExecSyncOptionsWithStringEncoding,
|
|
execSync as nodeExecSync,
|
|
} from 'child_process'
|
|
import { slowLogging } from './slowOperations.js'
|
|
|
|
/**
|
|
* @deprecated Use async alternatives when possible. Sync exec calls block the event loop.
|
|
*
|
|
* Wrapped execSync with slow operation logging.
|
|
* Use this instead of child_process execSync directly to detect performance issues.
|
|
*
|
|
* @example
|
|
* import { execSync_DEPRECATED } from './execSyncWrapper.js'
|
|
* const result = execSync_DEPRECATED('git status', { encoding: 'utf8' })
|
|
*/
|
|
export function execSync_DEPRECATED(command: string): Buffer
|
|
export function execSync_DEPRECATED(
|
|
command: string,
|
|
options: ExecSyncOptionsWithStringEncoding,
|
|
): string
|
|
export function execSync_DEPRECATED(
|
|
command: string,
|
|
options: ExecSyncOptionsWithBufferEncoding,
|
|
): Buffer
|
|
export function execSync_DEPRECATED(
|
|
command: string,
|
|
options?: ExecSyncOptions,
|
|
): Buffer | string
|
|
export function execSync_DEPRECATED(
|
|
command: string,
|
|
options?: ExecSyncOptions,
|
|
): Buffer | string {
|
|
using _ = slowLogging`execSync: ${command.slice(0, 100)}`
|
|
// Security: callers must ensure command arguments are from trusted sources.
|
|
// This wrapper uses child_process.execSync which invokes a shell and can
|
|
// lead to command injection if command contains untrusted input.
|
|
return nodeExecSync(command, options)
|
|
}
|