Conversation
| const outDir = join(__dirname, "..", "..", "typescriptlang-org", "public", "js", "examples"); | ||
|
|
||
| if (!existsSync(outDir)) execSync(`mkdir ${outDir}`); | ||
| if (!existsSync(outDir)) execSync(`mkdir -p ${outDir}`); |
Check warning
Code scanning / CodeQL
Shell command built from environment values Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 24 hours ago
In general, the fix is to avoid passing dynamically constructed command strings through a shell. Instead, call the underlying program directly and pass any dynamic values (like paths) as separate arguments, or better, use Node’s own filesystem operations when possible.
For this specific case, the best fix without changing observable functionality is to replace the execSync("mkdir -p ...") invocation with code that creates the directory using Node APIs. Since mkdir -p’s behavior is “create this directory and any missing parents, and don’t error if it already exists,” the direct analogue is fs.mkdirSync(outDir, { recursive: true }), or, since fs-extra is already imported as fse, fse.ensureDirSync(outDir). Using fs-extra keeps the code consistent with the rest of the file.
Concretely:
- In
packages/playground-examples/scripts/copyFiles.js, on line 12, replaceif (!existsSync(outDir)) execSync(\mkdir -p ${outDir}`);with a call tofse.ensureDirSync(outDir);`. - This removes the shell call entirely, so there is no longer any shell command built from environment values.
- No new imports are needed;
fseis already required fromfs-extra.
| @@ -9,7 +9,7 @@ | ||
| const jsonDir = join(__dirname, "..", "generated"); | ||
| const outDir = join(__dirname, "..", "..", "typescriptlang-org", "public", "js", "examples"); | ||
|
|
||
| if (!existsSync(outDir)) execSync(`mkdir -p ${outDir}`); | ||
| if (!existsSync(outDir)) fse.ensureDirSync(outDir); | ||
|
|
||
| // Move samples | ||
| fse.copySync(copyDir, outDir); |
No description provided.