Miscellaneous improvements

[michaelhogg]

Many thanks @shime for creating this nice little library :)

In this PR, I've made the following improvements:

• 0b3f617 – README.md: improve documentation of options
  • I thought it would be helpful to add links to the websites of the audio players.
• 9f8a1d4 – index.js: pass new Error to callback if no audio file is specified
• 1a11046 – index.js: improve file existence check
  • It's not safe to use stderr for checking file existence or for detecting whether a playback error occurred.  Some players (eg: mplayer) output non-fatal warnings to stderr (eg: information about missing codecs).  A much safer solution for checking file existence is to use fs.statSync().
• e7f2d1a – index.js: remove unused variables: util, self
• f0c92a9 – index.js: function parameter variables should not be redefined
• c6dda76 – index.js: remove unnecessary check for error
  • Nothing is gained by checking err here.  In the child_process.exec() callback, err will be null on success, so we can simply pass err to the user's callback, and let the user check for errors.
• 3af8bd8 – index.js: remove useless return in exec() callback
  • There's no point in returning a value from this callback, since it's executed by Node's child_process module, and any return value is simply discarded (see the source code here).
• b7f59ed – index.js: fix command injection vulnerability
  • Using child_process.exec() causes a command injection vulnerability.  For example: player.play('foo.mp3; rm -rf ~');  The solution is to use child_process.execFile(), which takes an array of arguments and passes them directly to the player.  For more details, see: Avoiding Command Injection in Node.js.
• 2b45215 – tests.js: update proxied child_process method to execFile()
• a154867 – tests.js: update spy.calledWith() to match child_process.execFile()
• 65f91db – tests.js: mock MP3 file is required when testing for missing players
• 1018e07 – tests.js: remove unnecessary call to spy.callsArg()
  • There's no need for the child_process.execFile() callback to be called.

[shime]

Oh wow! This is amazing! Thank you so much!

Could you just remove the file name from the commit messages, so they are more inline with the existing ones?

[michaelhogg]

You're welcome :)

I've just rebased the branch and removed the file name prefixes from the commit messages.