search

oldj / node-font-list

Get the list of fonts installed in the system.
MIT License
135 stars 21 forks source link

Security issue #9

Closed brettz9 closed 4 years ago

brettz9 commented 4 years ago

Hi,

The code at https://github.com/oldj/node-font-list/blob/master/libs/win32/index.js#L69-L71 is being flagged by https://lgtm.com/projects/g/oldj/node-font-list/?mode=list with an explanation for the concern at https://lgtm.com/rules/1510773276307/ . It appears that this concern could be minimized by using:

let cmd = 'cscript'
execFile(cmd, [fn], (err, stdout, stderr) => {

Btw, I find LGTM.com to be a useful site which picks up issues like this which ESLint does not (and across multiple languages), and they have an integration for your site's PRs in case you might be interested: https://lgtm.com/help/lgtm/github-apps-integration

oldj commented 4 years ago

Thanks!