chore: remove cjs exports and improve typescript performance #472
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| execCmd(["tsc", "--project", tsconfigEsmFile].join(" ")), | ||
| ]); | ||
|
|
||
| await execCmd(["tsc", "--project", tsconfigFile].join(" ")); |
Check warning
Code scanning / CodeQL
Shell command built from environment values Medium
| ]); | ||
|
|
||
| await execCmd(`shx ls ${distDir}/*.{tsx,ts} | xargs rm`); | ||
| await execCmd(["tsc", "--project", tsconfigFile].join(" ")); |
Check warning
Code scanning / CodeQL
Shell command built from environment values Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 14 days ago
To fix the issue, we will replace the use of execCmd with a safer alternative that avoids dynamically constructing the shell command. Specifically:
- Use
execFileorexecFileSyncinstead ofexecto pass the command and its arguments as separate parameters. This ensures that the shell does not interpret the arguments. - Modify the
execCmdcall on line 75 to passtsconfigFileas an argument to thetsccommand, rather than embedding it in a concatenated string.
This change will ensure that special characters in tsconfigFile are treated as literal values and not interpreted by the shell.
| @@ -74,3 +74,3 @@ | ||
| await execCmd(["shx", "cp", baseIconFile, distDir].join(" ")); | ||
| await execCmd(["tsc", "--project", tsconfigFile].join(" ")); | ||
| await execCmd("tsc", ["--project", tsconfigFile]); | ||
| await execCmd(`shx ls ${distDir}/*.{tsx,ts} | grep -v ".d.ts$" | xargs rm`); |
|
|
||
| await execCmd(`shx ls ${distDir}/*.{tsx,ts} | xargs rm`); | ||
| await execCmd(["tsc", "--project", tsconfigFile].join(" ")); | ||
| await execCmd(`shx ls ${distDir}/*.{tsx,ts} | grep -v ".d.ts$" | xargs rm`); |
Check warning
Code scanning / CodeQL
Shell command built from environment values Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 14 days ago
To fix the issue, we will replace the dynamically constructed shell command with a safer alternative that avoids shell interpretation. Specifically:
- Use
execFileorexecFileSyncinstead ofexecto pass arguments as an array, ensuring they are not interpreted by the shell. - Replace the
shx lsandgrepcommands with equivalent functionality implemented in JavaScript, avoiding the need for shell commands entirely.
The changes will focus on line 76, where the vulnerable shell command is executed.
| @@ -75,3 +75,7 @@ | ||
| await execCmd(["tsc", "--project", tsconfigFile].join(" ")); | ||
| await execCmd(`shx ls ${distDir}/*.{tsx,ts} | grep -v ".d.ts$" | xargs rm`); | ||
| const files = await fs.readdir(distDir); | ||
| const filesToDelete = files.filter(file => /\.(tsx|ts)$/.test(file) && !file.endsWith(".d.ts")); | ||
| await Promise.all( | ||
| filesToDelete.map(file => fs.rm(path.join(distDir, file))) | ||
| ); | ||
|
|
| ]); | ||
|
|
||
| await removeDirsExcept(distDir, ["cjs", "esm"]); | ||
| await execCmd(["tsc", "--project", tsconfigFile].join(" ")); |
Check warning
Code scanning / CodeQL
Shell command built from environment values Medium
| await removeDirsExcept(distDir, ["cjs", "esm"]); | ||
| await execCmd(["tsc", "--project", tsconfigFile].join(" ")); | ||
| await execCmd( | ||
| `shx ls ${distDir}/*.{tsx,ts} ${distDir}/**/*.{tsx,ts} | grep -v ".d.ts$" | xargs rm`, |
Check warning
Code scanning / CodeQL
Shell command built from environment values Medium
No description provided.