nocci/free-games-claimer
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 3

notify: use execFile with arg array instead of exec to avoid shell-escape, fixes #239

Browse source 
Also proper fix for https://github.com/vogler/free-games-claimer/pull/167

https://www.npmjs.com/package/shell-escape
https://stackoverflow.com/questions/1779858/how-do-i-escape-a-string-for-a-shell-command-in-node
https://nodejs.org/api/child_process.html#child_processexecfilefile-args-options-callback
This commit is contained in:
Ralf Vogler 2023-11-09 02:34:17 +01:00
parent a7cc68b6db
commit 3ddf1720bb
2 changed files with 14 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

14
util.js
View file

@ -85,13 +85,19 @@ export const prompt = o => enquirer.prompt({ name: 'name', type: 'input', messag
export const confirm = o => prompt({ type: 'confirm', message: 'Continue?', ...o });
// notifications via apprise CLI
import { exec } from 'child_process';
import { execFile } from 'child_process';
import { cfg } from './config.js';
export const notify = html => new Promise((resolve, reject) => {
if (!cfg.notify) return resolve();
const title = cfg.notify_title ? `-t ${cfg.notify_title}` : '';
exec(`apprise ${cfg.notify} -i html '${title}' -b '${html}'`, (error, stdout, stderr) => {
if (!cfg.notify) {
if (cfg.debug) console.debug('notify: NOTIFY is not set!');
return resolve();
}
// const cmd = `apprise '${cfg.notify}' ${title} -i html -b '${html}'`; // this had problems if e.g. ' was used in arg; could have `npm i shell-escape`, but instead using safer execFile which takes args as array instead of exec which spawned a shell to execute the command
const args = [cfg.notify, '-i', 'html', '-b', html];
if (cfg.notify_title) args.push(...['-t', cfg.notify_title]);
if (cfg.debug) console.debug(`apprise ${args.map(a => `'${a}'`).join(' ')}`); // this also doesn't escape, but it's just for info
execFile('apprise', args, (error, stdout, stderr) => {
if (error) {
console.log(`error: ${error.message}`);
if (error.message.includes('command not found')) {