Fix potential command injection vulnerability

pahen · Mar 5, 2021 · da5cbc9 · da5cbc9
1 parent c0600c4
commit da5cbc9
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 14 deletions.
diff --git a/lib/graph.js b/lib/graph.js
@@ -4,7 +4,7 @@ const path = require('path');
 const {promisify} = require('util');
 const graphviz = require('graphviz');
 
-const exec = promisify(require('child_process').exec);
+const exec = promisify(require('child_process').execFile);
 const writeFile = promisify(require('fs').writeFile);
 
 /**
@@ -22,19 +22,14 @@ function setNodeColor(node, color) {
  * @param  {Object} config
  * @return {Promise}
  */
-function checkGraphvizInstalled(config) {
-	if (config.graphVizPath) {
-		const cmd = path.join(config.graphVizPath, 'gvpr -V');
-		return exec(cmd)
-			.catch(() => {
-				throw new Error('Could not execute ' + cmd);
-			});
-	}
+async function checkGraphvizInstalled(config) {
+	const cmd = config.graphVizPath ? path.join(config.graphVizPath, 'gvpr') : 'gvpr';
 
-	return exec('gvpr -V')
-		.catch((error) => {
-			throw new Error('Graphviz could not be found. Ensure that "gvpr" is in your $PATH.\n' + error);
-		});
+	try {
+		await exec(cmd, ['-V']);
+	} catch (err) {
+		throw new Error(`Graphviz could not be found. Ensure that "gvpr" is in your $PATH. ${err}`);
+	}
 }
 
 /**

diff --git a/test/api.js b/test/api.js
@@ -313,7 +313,7 @@ describe('API', () => {
 			madge(__dirname + '/cjs/a.js', {graphVizPath: '/invalid/path'})
 				.then((res) => res.image('image.png'))
 				.catch((err) => {
-					err.message.should.match(/Could not execute .*gvpr \-V/);
+					err.message.should.eql('Graphviz could not be found. Ensure that "gvpr" is in your $PATH. Error: spawn /invalid/path/gvpr ENOENT');
 					done();
 				});
 		});