search

fedwiki / wiki-plugin-plugmatic

Administer Installed Plugins
2 stars 3 forks source link

make calling npm safer #4

Closed paul90 closed 7 years ago

paul90 commented 7 years ago

The use of exec is not really all that safe. Without validation of the input parameters, on the server, it would be fairly simple to perform arbitrary commands on the server.

Here I use execFile to run npm, and some simple validation of plugin and version input on server.

WardCunningham commented 7 years ago

Oops. Sorry to be slow to merge this excellent addition.