Skip to content

Commit 235127e

Browse files
committed
Sanitize binary args passed by user
1 parent 230ec93 commit 235127e

File tree

1 file changed

+11
-4
lines changed

1 file changed

+11
-4
lines changed

lib/Local.js

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
var childProcess = require('child_process'),
2+
os = require('os'),
23
fs = require('fs'),
34
path = require('path'),
45
running = require('is-running'),
@@ -7,11 +8,12 @@ var childProcess = require('child_process'),
78
psTree = require('ps-tree');
89

910
function Local(){
11+
this.windows = os.platform().match(/mswin|msys|mingw|cygwin|bccwin|wince|emc|win32/i);
1012
this.pid = undefined;
1113
this.isProcessRunning = false;
1214
this.retriesLeft = 5;
1315
this.key = process.env.BROWSERSTACK_ACCESS_KEY;
14-
this.logfile = path.join(process.cwd(), 'local.log');
16+
this.logfile = this.sanitizePath(path.join(process.cwd(), 'local.log'));
1517
this.opcode = 'start';
1618
this.exitCallback;
1719

@@ -124,7 +126,7 @@ function Local(){
124126
case 'folder':
125127
if(value){
126128
this.folderFlag = '-f';
127-
this.folderPath = value;
129+
this.folderPath = this.sanitizePath(value);
128130
}
129131
break;
130132

@@ -157,7 +159,7 @@ function Local(){
157159
case 'logfile':
158160
case 'logFile':
159161
if(value)
160-
this.logfile = value;
162+
this.logfile = this.sanitizePath(value);
161163
break;
162164

163165
case 'parallelRuns':
@@ -167,7 +169,7 @@ function Local(){
167169

168170
case 'binarypath':
169171
if(value)
170-
this.binaryPath = value;
172+
this.binaryPath = this.sanitizePath(value);
171173
break;
172174

173175
default:
@@ -253,6 +255,11 @@ function Local(){
253255
return args;
254256
};
255257

258+
this.sanitizePath = function(rawPath) {
259+
var doubleQuoteIfRequired = this.windows && !rawPath.match(/"[^"]+"/) ? '"' : '';
260+
return doubleQuoteIfRequired + rawPath + doubleQuoteIfRequired;
261+
}
262+
256263
this.killAllProcesses = function(callback){
257264
psTree(this.pid, (err, children) => {
258265
var childPids = children.map(val => val.PID);

0 commit comments

Comments
 (0)