Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Sign up
Appearance settings

Commit a790379

Browse files
author
Akos Kitta
committed
fix: removed unsafe shell when executing process
Ref: PNX-3671 Co-authored-by: per1234 <accounts@perglass.com> Co-authored-by: Akos Kitta <a.kitta@arduino.cc> Signed-off-by: Akos Kitta <a.kitta@arduino.cc>
1 parent e47fb2e commit a790379

File tree

12 files changed

+388
-220
lines changed

12 files changed

+388
-220
lines changed

‎arduino-ide-extension/package.json‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -104,17 +104,14 @@
104104
"temp": "^0.9.1",
105105
"temp-dir": "^2.0.0",
106106
"tree-kill": "^1.2.1",
107-
"util": "^0.12.5",
108-
"which": "^1.3.1"
107+
"util": "^0.12.5"
109108
},
110109
"devDependencies": {
111110
"@octokit/rest": "^18.12.0",
112111
"@types/chai": "^4.2.7",
113-
"@types/chai-string": "^1.4.2",
114112
"@types/mocha": "^5.2.7",
115113
"@types/react-window": "^1.8.5",
116114
"chai": "^4.2.0",
117-
"chai-string": "^1.5.0",
118115
"decompress": "^4.2.0",
119116
"decompress-tarbz2": "^4.1.1",
120117
"decompress-targz": "^4.1.1",

‎arduino-ide-extension/src/common/protocol/executable-service.ts‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,5 @@ export interface ExecutableService {
55
clangdUri: string;
66
cliUri: string;
77
lsUri: string;
8-
fwuploaderUri: string;
98
}>;
109
}

‎arduino-ide-extension/src/node/arduino-daemon-impl.ts‎

Lines changed: 6 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,6 @@ export class ArduinoDaemonImpl
4444

4545
private _running = false;
4646
private _port = new Deferred<string>();
47-
private _execPath: string | undefined;
4847

4948
// Backend application lifecycle.
5049

@@ -68,7 +67,7 @@ export class ArduinoDaemonImpl
6867
async start(): Promise<string> {
6968
try {
7069
this.toDispose.dispose(); // This will `kill` the previously started daemon process, if any.
71-
const cliPath = awaitthis.getExecPath();
70+
const cliPath = this.getExecPath();
7271
this.onData(`Starting daemon from ${cliPath}...`);
7372
const { daemon, port } = await this.spawnDaemonProcess();
7473
// Watchdog process for terminating the daemon process when the backend app terminates.
@@ -132,12 +131,8 @@ export class ArduinoDaemonImpl
132131
return this.onDaemonStoppedEmitter.event;
133132
}
134133

135-
async getExecPath(): Promise<string> {
136-
if (this._execPath) {
137-
return this._execPath;
138-
}
139-
this._execPath = await getExecPath('arduino-cli', this.onError.bind(this));
140-
return this._execPath;
134+
getExecPath(): string {
135+
return getExecPath('arduino-cli');
141136
}
142137

143138
protected async getSpawnArgs(): Promise<string[]> {
@@ -151,7 +146,7 @@ export class ArduinoDaemonImpl
151146
'--port',
152147
'0',
153148
'--config-file',
154-
`"${cliConfigPath}"`,
149+
cliConfigPath,
155150
'-v',
156151
];
157152
if (debug) {
@@ -173,10 +168,8 @@ export class ArduinoDaemonImpl
173168
daemon: ChildProcess;
174169
port: string;
175170
}> {
176-
const [cliPath, args] = await Promise.all([
177-
this.getExecPath(),
178-
this.getSpawnArgs(),
179-
]);
171+
const args = await this.getSpawnArgs();
172+
const cliPath = this.getExecPath();
180173
const ready = new Deferred<{ daemon: ChildProcess; port: string }>();
181174
const options = { shell: true };
182175
const daemon = spawn(`"${cliPath}"`, args, options);
Lines changed: 17 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -1,45 +1,22 @@
1+
import { ILogger } from '@theia/core/lib/common/logger';
2+
import { inject, injectable, named } from '@theia/core/shared/inversify';
3+
import type { Port } from '../common/protocol';
14
import {
25
ArduinoFirmwareUploader,
36
FirmwareInfo,
47
} from '../common/protocol/arduino-firmware-uploader';
5-
import { injectable, inject, named } from '@theia/core/shared/inversify';
6-
import { ExecutableService, Port } from '../common/protocol';
78
import { getExecPath, spawnCommand } from './exec-util';
8-
import { ILogger } from '@theia/core/lib/common/logger';
99
import { MonitorManager } from './monitor-manager';
1010

1111
@injectable()
1212
export class ArduinoFirmwareUploaderImpl implements ArduinoFirmwareUploader {
13-
@inject(ExecutableService)
14-
protected executableService: ExecutableService;
15-
16-
protected _execPath: string | undefined;
17-
1813
@inject(ILogger)
1914
@named('fwuploader')
20-
protected readonly logger: ILogger;
21-
15+
private readonly logger: ILogger;
2216
@inject(MonitorManager)
23-
protected readonly monitorManager: MonitorManager;
24-
25-
protected onError(error: any): void {
26-
this.logger.error(error);
27-
}
28-
29-
async getExecPath(): Promise<string> {
30-
if (this._execPath) {
31-
return this._execPath;
32-
}
33-
this._execPath = await getExecPath('arduino-fwuploader');
34-
return this._execPath;
35-
}
36-
37-
async runCommand(args: string[]): Promise<any> {
38-
const execPath = await this.getExecPath();
39-
return await spawnCommand(`"${execPath}"`, args, this.onError.bind(this));
40-
}
17+
private readonly monitorManager: MonitorManager;
4118

42-
async uploadCertificates(command: string): Promise<any> {
19+
async uploadCertificates(command: string): Promise<string> {
4320
return await this.runCommand(['certificates', 'flash', command]);
4421
}
4522

@@ -70,14 +47,13 @@ export class ArduinoFirmwareUploaderImpl implements ArduinoFirmwareUploader {
7047
}
7148

7249
async flash(firmware: FirmwareInfo, port: Port): Promise<string> {
73-
let output;
7450
const board = {
7551
name: firmware.board_name,
7652
fqbn: firmware.board_fqbn,
7753
};
7854
try {
7955
await this.monitorManager.notifyUploadStarted(board.fqbn, port);
80-
output = await this.runCommand([
56+
constoutput = await this.runCommand([
8157
'firmware',
8258
'flash',
8359
'--fqbn',
@@ -87,11 +63,18 @@ export class ArduinoFirmwareUploaderImpl implements ArduinoFirmwareUploader {
8763
'--module',
8864
`${firmware.module}@${firmware.firmware_version}`,
8965
]);
90-
} catch (e) {
91-
throw e;
66+
return output;
9267
} finally {
9368
await this.monitorManager.notifyUploadFinished(board.fqbn, port);
94-
return output;
9569
}
9670
}
71+
72+
private onError(error: Error): void {
73+
this.logger.error(error);
74+
}
75+
76+
private async runCommand(args: string[]): Promise<string> {
77+
const execPath = getExecPath('arduino-fwuploader');
78+
return await spawnCommand(execPath, args, this.onError.bind(this));
79+
}
9780
}

‎arduino-ide-extension/src/node/clang-formatter.ts‎

Lines changed: 17 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,3 @@
1-
import * as os from 'node:os';
21
import { EnvVariablesServer } from '@theia/core/lib/common/env-variables';
32
import { MaybePromise } from '@theia/core/lib/common/types';
43
import { FileUri } from '@theia/core/lib/node/file-uri';
@@ -15,7 +14,7 @@ export class ClangFormatter implements Formatter {
1514
private readonly configService: ConfigService;
1615

1716
@inject(EnvVariablesServer)
18-
private readonly envVariableServer: EnvVariablesServer;
17+
private readonly envVariablesServer: EnvVariablesServer;
1918

2019
async format({
2120
content,
@@ -26,26 +25,19 @@ export class ClangFormatter implements Formatter {
2625
formatterConfigFolderUris: string[];
2726
options?: FormatterOptions;
2827
}): Promise<string> {
29-
const [execPath, style] = await Promise.all([
30-
this.execPath(),
31-
this.style(formatterConfigFolderUris, options),
32-
]);
28+
const execPath = this.execPath();
29+
const args = await this.styleArgs(formatterConfigFolderUris, options);
3330
const formatted = await spawnCommand(
34-
`"${execPath}"`,
35-
[style],
31+
execPath,
32+
args,
3633
console.error,
3734
content
3835
);
3936
return formatted;
4037
}
4138

42-
private _execPath: string | undefined;
43-
private async execPath(): Promise<string> {
44-
if (this._execPath) {
45-
return this._execPath;
46-
}
47-
this._execPath = await getExecPath('clang-format');
48-
return this._execPath;
39+
private execPath(): string {
40+
return getExecPath('clang-format');
4941
}
5042

5143
/**
@@ -60,10 +52,10 @@ export class ClangFormatter implements Formatter {
6052
*
6153
* See: https://github.com/arduino/arduino-ide/issues/566
6254
*/
63-
private async style(
55+
private async styleArgs(
6456
formatterConfigFolderUris: string[],
6557
options?: FormatterOptions
66-
): Promise<string> {
58+
): Promise<string[]> {
6759
const clangFormatPaths = await Promise.all([
6860
...formatterConfigFolderUris.map((uri) => this.clangConfigPath(uri)),
6961
this.clangConfigPath(this.configDirPath()),
@@ -72,11 +64,11 @@ export class ClangFormatter implements Formatter {
7264
const first = clangFormatPaths.filter(Boolean).shift();
7365
if (first) {
7466
console.debug(
75-
`Using ${ClangFormatFile} style configuration from '${first}'.`
67+
`Using ${clangFormatFilename} style configuration from '${first}'.`
7668
);
77-
return `-style=file:"${first}"`;
69+
return ['-style',`file:${first}`];
7870
}
79-
return `-style="${style(toClangOptions(options))}"`;
71+
return ['-style',style(toClangOptions(options))];
8072
}
8173

8274
private async dataDirPath(): Promise<string | undefined> {
@@ -88,7 +80,7 @@ export class ClangFormatter implements Formatter {
8880
}
8981

9082
private async configDirPath(): Promise<string> {
91-
const configDirUri = await this.envVariableServer.getConfigDirUri();
83+
const configDirUri = await this.envVariablesServer.getConfigDirUri();
9284
return FileUri.fsPath(configDirUri);
9385
}
9486

@@ -100,7 +92,7 @@ export class ClangFormatter implements Formatter {
10092
return undefined;
10193
}
10294
const folderPath = FileUri.fsPath(uri);
103-
const clangFormatPath = join(folderPath, ClangFormatFile);
95+
const clangFormatPath = join(folderPath, clangFormatFilename);
10496
try {
10597
await fs.access(clangFormatPath, constants.R_OK);
10698
return clangFormatPath;
@@ -115,7 +107,7 @@ interface ClangFormatOptions {
115107
readonly TabWidth: number;
116108
}
117109

118-
const ClangFormatFile = '.clang-format';
110+
exportconst clangFormatFilename = '.clang-format';
119111

120112
function toClangOptions(
121113
options?: FormatterOptions | undefined
@@ -129,24 +121,8 @@ function toClangOptions(
129121
return { UseTab: 'Never', TabWidth: 2 };
130122
}
131123

132-
export function style({ TabWidth, UseTab }: ClangFormatOptions): string {
133-
let styleArgument = JSON.stringify(styleJson({ TabWidth, UseTab })).replace(
134-
/[\\"]/g,
135-
'\\$&'
136-
);
137-
if (os.platform() === 'win32') {
138-
// Windows command interpreter does not use backslash escapes. This causes the argument to have alternate quoted and
139-
// unquoted sections.
140-
// Special characters in the unquoted sections must be caret escaped.
141-
const styleArgumentSplit = styleArgument.split('"');
142-
for (let i = 1; i < styleArgumentSplit.length; i += 2) {
143-
styleArgumentSplit[i] = styleArgumentSplit[i].replace(/[<>^|]/g, '^$&');
144-
}
145-
146-
styleArgument = styleArgumentSplit.join('"');
147-
}
148-
149-
return styleArgument;
124+
function style({ TabWidth, UseTab }: ClangFormatOptions): string {
125+
return JSON.stringify(styleJson({ TabWidth, UseTab }));
150126
}
151127

152128
function styleJson({

‎arduino-ide-extension/src/node/config-service-impl.ts‎

Lines changed: 4 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -222,8 +222,8 @@ export class ConfigServiceImpl
222222
}
223223

224224
private async getFallbackCliConfig(): Promise<DefaultCliConfig> {
225-
const cliPath = awaitthis.daemon.getExecPath();
226-
const rawJson = await spawnCommand(`"${cliPath}"`, [
225+
const cliPath = this.daemon.getExecPath();
226+
const rawJson = await spawnCommand(cliPath, [
227227
'config',
228228
'dump',
229229
'format',
@@ -233,13 +233,8 @@ export class ConfigServiceImpl
233233
}
234234

235235
private async initCliConfigTo(fsPathToDir: string): Promise<void> {
236-
const cliPath = await this.daemon.getExecPath();
237-
await spawnCommand(`"${cliPath}"`, [
238-
'config',
239-
'init',
240-
'--dest-dir',
241-
`"${fsPathToDir}"`,
242-
]);
236+
const cliPath = this.daemon.getExecPath();
237+
await spawnCommand(cliPath, ['config', 'init', '--dest-dir', fsPathToDir]);
243238
}
244239

245240
private async mapCliConfigToAppConfig(

‎arduino-ide-extension/src/node/exec-util.ts‎

Lines changed: 12 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -1,51 +1,17 @@
1+
import { spawn } from 'node:child_process';
12
import os from 'node:os';
2-
import which from 'which';
3-
import semver from 'semver';
43
import { join } from 'node:path';
5-
import { spawn } from 'node:child_process';
64

7-
export async function getExecPath(
8-
commandName: string,
9-
onError: (error: Error) => void = (error) => console.log(error),
10-
versionArg?: string | undefined,
11-
inBinDir?: boolean
12-
): Promise<string> {
13-
const execName = `${commandName}${os.platform() === 'win32' ? '.exe' : ''}`;
14-
const relativePath = ['..', '..', 'build'];
15-
if (inBinDir) {
16-
relativePath.push('bin');
17-
}
18-
const buildCommand = join(__dirname, ...relativePath, execName);
19-
if (!versionArg) {
20-
return buildCommand;
21-
}
22-
const versionRegexp = /\d+\.\d+\.\d+/;
23-
const buildVersion = await spawnCommand(
24-
`"${buildCommand}"`,
25-
[versionArg],
26-
onError
27-
);
28-
const buildShortVersion = (buildVersion.match(versionRegexp) || [])[0];
29-
const pathCommand = await new Promise<string | undefined>((resolve) =>
30-
which(execName, (error, path) => resolve(error ? undefined : path))
31-
);
32-
if (!pathCommand) {
33-
return buildCommand;
34-
}
35-
const pathVersion = await spawnCommand(
36-
`"${pathCommand}"`,
37-
[versionArg],
38-
onError
39-
);
40-
const pathShortVersion = (pathVersion.match(versionRegexp) || [])[0];
41-
if (
42-
pathShortVersion &&
43-
buildShortVersion &&
44-
semver.gt(pathShortVersion, buildShortVersion)
45-
) {
46-
return pathCommand;
47-
}
48-
return buildCommand;
5+
export type ArduinoBinaryName =
6+
| 'arduino-cli'
7+
| 'arduino-fwuploader'
8+
| 'arduino-language-server';
9+
export type ClangBinaryName = 'clangd' | 'clang-format';
10+
export type BinaryName = ArduinoBinaryName | ClangBinaryName;
11+
12+
export function getExecPath(binaryName: BinaryName): string {
13+
const filename = `${binaryName}${os.platform() === 'win32' ? '.exe' : ''}`;
14+
return join(__dirname, '..', '..', 'build', filename);
4915
}
5016

5117
export function spawnCommand(
@@ -55,7 +21,7 @@ export function spawnCommand(
5521
stdIn?: string
5622
): Promise<string> {
5723
return new Promise<string>((resolve, reject) => {
58-
const cp = spawn(command, args, { windowsHide: true,shell: true });
24+
const cp = spawn(command, args, { windowsHide: true });
5925
const outBuffers: Buffer[] = [];
6026
const errBuffers: Buffer[] = [];
6127
cp.stdout.on('data', (b: Buffer) => outBuffers.push(b));

0 commit comments

Comments
(0)

AltStyle によって変換されたページ (->オリジナル) /