Skip to content

Conversation

antongolub
Copy link
Collaborator

closes #1337

await assert.rejects(() => kill(''), /Invalid/)
await assert.rejects(() => kill('foo'), /Invalid/)
await assert.rejects(() => kill('100 foo'), /Invalid/)
await assert.rejects(() => kill(100.1), /Invalid/)
await assert.rejects(() => kill(null), /Invalid/)
await assert.rejects(() => kill({}), /Invalid/)
  • Tests pass
  • Appropriate changes to README are included in PR

Copy link

@Copilot Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR adds input validation to the kill() function to ensure it only accepts valid process IDs. The function now validates that the PID is a valid positive integer, rejecting empty strings, non-numeric values, floats, and other invalid inputs.

  • Adds input validation to reject invalid PID formats
  • Updates type signature to accept string numbers alongside numeric PIDs
  • Includes comprehensive test coverage for various invalid input scenarios

Reviewed Changes

Copilot reviewed 5 out of 7 changed files in this pull request and generated 1 comment.

Show a summary per file
File Description
src/core.ts Adds PID validation logic and updates function signature
src/log.ts Updates LogEntry type to accept string number PIDs
test/core.test.js Adds test cases for invalid PID validation
build/core.cjs Compiled JavaScript output with validation logic
.size-limit.json Updates bundle size limits to account for added validation code

Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

Comment on lines 1044 to 1046
pid = (pid + '') as `${number}`
if (!/^\d+$/.test(pid)) throw new Fail(`Invalid pid: ${pid}`)

Copy link
Preview

Copilot AI Sep 19, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The type assertion as \${number}`is misleading since the validation hasn't occurred yet. At this point,pid + ''` could be any string (e.g., 'null', 'undefined', '[object Object]'). Consider moving the type assertion after the validation or using a different approach.

Suggested change
pid = (pid + '') as `${number}`
if (!/^\d+$/.test(pid)) throw new Fail(`Invalid pid: ${pid}`)
const pidStr = pid + '';
if (!/^\d+$/.test(pidStr)) throw new Fail(`Invalid pid: ${pidStr}`);
pid = pidStr as `${number}`;

Copilot uses AI. Check for mistakes.

@antongolub antongolub requested a review from Copilot September 19, 2025 20:03
Copy link

@Copilot Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

Copilot reviewed 5 out of 7 changed files in this pull request and generated no new comments.


Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

@antongolub antongolub merged commit d9fc297 into google:main Sep 19, 2025
29 checks passed
@antongolub antongolub deleted the fix-kill-input branch September 19, 2025 20:05
antongolub added a commit to antongolub/zx that referenced this pull request Sep 20, 2025
antonmedv pushed a commit that referenced this pull request Sep 20, 2025
* refactor: strengthen `kill` input check

continues #1339

* ci: check tag with pkg version
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Command Injection in zx kill() Function (Windows Specific)
1 participant