huntr - Command Injection Fix (#18)

Co-authored-by: jammy <[email protected]> Co-authored-by: Paweł Trysła <[email protected]>
zamotany · Apr 7, 2020 · ef2f673 · ef2f673
1 parent e1e2296
commit ef2f673
Showing 1 changed file with 9 additions and 6 deletions.
diff --git a/src/android/adb.ts b/src/android/adb.ts
@@ -1,4 +1,4 @@
-import { spawn, execSync, ChildProcess } from 'child_process';
+import { spawn, execFileSync, ChildProcess } from 'child_process';
 import path from 'path';
 import {
   CodeError,
@@ -25,7 +25,7 @@ export function getAdbPath(customPath?: string): string {
 
 export function spawnLogcatProcess(adbPath: string): ChildProcess {
   try {
-    execSync(`${adbPath} logcat -c`);
+    execFileSync(adbPath, ['logcat', '-c']);
   } catch (error) {
     throw new CodeError(
       ERR_ANDROID_CANNOT_CLEAN_LOGCAT_BUFFER,
@@ -49,11 +49,14 @@ export function getApplicationPid(
   applicationId: string,
   adbPath?: string
 ): number {
-  let output: Buffer | undefined;
+  let output: Buffer | String | undefined;
   try {
-    output = execSync(
-      `'${getAdbPath(adbPath)}' shell pidof -s ${applicationId}`
-    );
+    output = execFileSync(getAdbPath(adbPath), [
+      'shell',
+      'pidof',
+      '-s',
+      applicationId,
+    ]);
   } catch (error) {
     throw new CodeError(
       ERR_ANDROID_CANNOT_GET_APP_PID,