Merge pull request #197 from snyk/fix/quote-spawn-args

fix: quote spawn args

.snyk

@@ -0,0 +1,11 @@
+# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
+version: v1.25.0
+# ignores vulnerabilities until expiry date; change duration by modifying expiry date
+ignore:
+  'snyk:lic:npm:shescape:MPL-2.0':
+    - '*':
+        reason: None Given
+        expires: 2122-12-29T08:08:41.608Z
+        created: 2022-11-29T08:08:41.611Z
+patch: {}
+

lib/dependencies/sub-process.ts

@@ -1,4 +1,5 @@
 import { spawn, spawnSync, SpawnOptions } from 'child_process';
+import { quoteAll } from 'shescape';
 
 interface ProcessOptions {
   cwd?: string;
@@ -22,6 +23,7 @@ export function execute(
   options?: ProcessOptions
 ): Promise<string> {
   const spawnOptions = makeSpawnOptions(options);
+  args = quoteAll(args, spawnOptions);
   return new Promise((resolve, reject) => {
     let stdout = '';
     let stderr = '';
@@ -49,6 +51,7 @@ export function executeSync(
   options?: ProcessOptions
 ) {
   const spawnOptions = makeSpawnOptions(options);
+  args = quoteAll(args, spawnOptions);
 
   return spawnSync(command, args, spawnOptions);
 }

package.json

@@ -25,6 +25,7 @@
   "dependencies": {
     "@snyk/cli-interface": "^2.11.2",
     "@snyk/dep-graph": "^1.28.1",
+    "shescape": "1.6.1",
     "snyk-poetry-lockfile-parser": "^1.1.7",
     "tmp": "0.2.1"
   },