Conversation
to test:
this code should render a button with fully
rounded corners
```
<Button
themeOverride={{borderRadius: '100px'}}
>sdfdsf</Button>
```
check theme override pages in the docs
…selection and hoverable prop
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
|
||
| function bootstrap() { | ||
| execSync(path.resolve('scripts/clean.js'), opts) |
Check warning
Code scanning / CodeQL
Shell command built from environment values Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 11 days ago
In general, the correct fix is to avoid passing dynamically constructed paths as part of a shell command string. Instead, use execFileSync (or an equivalent API) where the executable and each argument are provided in a separate array element, so no shell is involved, or explicitly run node with the script path as an argument. This ensures that spaces and special characters in the path are passed literally to the child process rather than being interpreted by a shell.
For this specific case in scripts/bootstrap.js, the cleanest change is to replace execSync(path.resolve('scripts/clean.js'), opts) with a call that runs node on that script using execFileSync. We already import execSync and fork from child_process; we can extend that import to also include execFileSync. Then, in bootstrap(), we call execFileSync(process.execPath, [path.resolve('scripts/clean.js')], opts). process.execPath is the absolute path of the Node binary running this script, so this reliably executes the local scripts/clean.js file without going through a shell. No other behavior of the script changes, and the existing opts with { stdio: 'inherit' } is reused so output behavior stays the same. All other uses of execSync in this file are hard-coded string commands without dynamic paths and can remain as they are per the recommendation.
Concretely:
- Update the
require('child_process')destructuring to also importexecFileSync. - Replace the
execSync(path.resolve('scripts/clean.js'), opts)line inbootstrap()with anexecFileSynccall usingprocess.execPathand the resolved script path as its argument array.
| @@ -24,7 +24,7 @@ | ||
| * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE | ||
| * SOFTWARE. | ||
| */ | ||
| const { execSync, fork } = require('child_process') | ||
| const { execSync, execFileSync, fork } = require('child_process') | ||
| const path = require('path') | ||
|
|
||
| const opts = { stdio: 'inherit' } | ||
| @@ -65,7 +65,7 @@ | ||
| } | ||
|
|
||
| function bootstrap() { | ||
| execSync(path.resolve('scripts/clean.js'), opts) | ||
| execFileSync(process.execPath, [path.resolve('scripts/clean.js')], opts) | ||
| buildProject() | ||
| } | ||
|
|
|
8 participants
No description provided.