Skip to content

fix: harden npm shell commands #309

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
damacus wants to merge 1 commit into
base: main
Choose a base branch
from
+17 −14
Open

fix: harden npm shell commands #309

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions libraries/nodejs_helper.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,7 @@
# frozen_string_literal: true

require 'shellwords'

module NodeJs
module Helper
def default_install_method
Expand Down Expand Up @@ -94,9 +96,9 @@ def npm_dist(version, url = nil)
def npm_list(package, path = nil, environment = {})
require 'json'
cmd = if path
Mixlib::ShellOut.new("npm list #{package} -json", cwd: path, environment: environment)
Mixlib::ShellOut.new(Shellwords.join(['npm', 'list', package, '-json']), cwd: path, environment: environment)
else
Mixlib::ShellOut.new("npm list #{package} -global -json", environment: environment)
Mixlib::ShellOut.new(Shellwords.join(['npm', 'list', package, '-global', '-json']), environment: environment)
end

begin
Expand Down
19 changes: 10 additions & 9 deletions resources/npm_package.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,7 @@
# frozen_string_literal: true

require 'shellwords'

provides :npm_package
unified_mode true

Expand All @@ -23,7 +25,7 @@
action :install do
execute "install NPM package #{new_resource.package}" do
cwd new_resource.path
command "npm install #{npm_options}"
command Shellwords.join(['npm', 'install', *npm_options])
user new_resource.user
group new_resource.group
environment npm_env_vars
Expand All @@ -36,7 +38,7 @@
action :uninstall do
execute "uninstall NPM package #{new_resource.package}" do
cwd new_resource.path
command "npm uninstall #{npm_options}"
command Shellwords.join(['npm', 'uninstall', *npm_options])
user new_resource.user
group new_resource.group
environment npm_env_vars
Expand All @@ -49,7 +51,7 @@
action :remove do
execute "uninstall NPM package #{new_resource.package}" do
cwd new_resource.path
command "npm uninstall #{npm_options}"
command Shellwords.join(['npm', 'uninstall', *npm_options])
user new_resource.user
group new_resource.group
environment npm_env_vars
Expand Down Expand Up @@ -87,12 +89,11 @@ def no_auto_update?
end

def npm_options
options = +''
options << ' -global' unless new_resource.path
new_resource.options.each do |option|
options << " #{option}"
end
options << " #{npm_package}"
options = []
options << '-global' unless new_resource.path
options.concat(new_resource.options)
options << npm_package if npm_package
options
end

def npm_package
Expand Down
6 changes: 3 additions & 3 deletions spec/unit/resources/npm_package_spec.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@
npm_package 'express'
end

it { is_expected.to run_execute('install NPM package express').with(command: 'npm install -global express') }
it { is_expected.to run_execute('install NPM package express').with(command: 'npm install -global express') }
end

context 'install a versioned package' do
Expand All @@ -22,14 +22,14 @@
end
end

it { is_expected.to run_execute('install NPM package async').with(command: 'npm install -global --production async@0.6.2') }
it { is_expected.to run_execute('install NPM package async').with(command: 'npm install -global --production async@0.6.2') }
end

context 'install with the legacy alias' do
recipe do
nodejs_npm 'mocha'
end

it { is_expected.to run_execute('install NPM package mocha').with(command: 'npm install -global mocha') }
it { is_expected.to run_execute('install NPM package mocha').with(command: 'npm install -global mocha') }
end
end
Loading