lee/tabby
1
0
Fork 0
mirror of https://github.com/eugeny/tabby synced 2026-08-23 14:27:13 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix: replace exec() with execFile() to prevent shell injection in shellIntegration.service (#11290)

Browse Source
This commit is contained in:
Utkarsh Adhran
2026-07-12 00:25:55 +02:00
committed by GitHub
parent e929ff0dd8
commit 2e4a5e6f2c
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tabby-electron/src/services/shellIntegration.service.ts
+3 -3
View File
@@ -1,6 +1,6 @@
import * as path from 'path'
import * as fs from 'mz/fs'
import { exec } from 'mz/child_process'
import { execFile } from 'mz/child_process'
import { Injectable } from '@angular/core'
import { HostAppService, Platform } from 'tabby-core'
import { ElectronService } from '../services/electron.service'
@@ -63,7 +63,7 @@ export class ShellIntegrationService {
const exe: string = process.env.PORTABLE_EXECUTABLE_FILE ?? this.electron.app.getPath('exe')
if (this.hostApp.platform === Platform.macOS) {
for (const wf of this.automatorWorkflows) {
await exec(`cp -r "${this.automatorWorkflowsLocation}/${wf}" "${this.automatorWorkflowsDestination}"`)
await execFile('cp', ['-r', path.join(this.automatorWorkflowsLocation, wf), this.automatorWorkflowsDestination])
}
} else if (this.hostApp.platform === Platform.Windows) {
for (const registryKey of this.registryKeys) {
@@ -86,7 +86,7 @@ export class ShellIntegrationService {
async remove (): Promise<void> {
if (this.hostApp.platform === Platform.macOS) {
for (const wf of this.automatorWorkflows) {
await exec(`rm -rf "${this.automatorWorkflowsDestination}/${wf}"`)
await execFile('rm', ['-rf', path.join(this.automatorWorkflowsDestination, wf)])
}
} else if (this.hostApp.platform === Platform.Windows) {
for (const registryKey of this.registryKeys) {