diff options
author | Aleksey Kladov <[email protected]> | 2021-05-31 17:51:19 +0100 |
---|---|---|
committer | Aleksey Kladov <[email protected]> | 2021-05-31 18:11:36 +0100 |
commit | ee995dbfd441e20bba21306c41aec0049c1d7da4 (patch) | |
tree | 0e81cc310ee7c9ee908c864c4f7eb2177283ccb3 /editors/code/src | |
parent | 020610f4539f5d553179e0b4dae46cae9db93e41 (diff) |
fix: fix shell injection in task spawning
closes #9058
Diffstat (limited to 'editors/code/src')
-rw-r--r-- | editors/code/src/tasks.ts | 12 |
1 files changed, 6 insertions, 6 deletions
diff --git a/editors/code/src/tasks.ts b/editors/code/src/tasks.ts index 694ee1e41..947b3f2e4 100644 --- a/editors/code/src/tasks.ts +++ b/editors/code/src/tasks.ts | |||
@@ -80,7 +80,7 @@ export async function buildCargoTask( | |||
80 | throwOnError: boolean = false | 80 | throwOnError: boolean = false |
81 | ): Promise<vscode.Task> { | 81 | ): Promise<vscode.Task> { |
82 | 82 | ||
83 | let exec: vscode.ShellExecution | undefined = undefined; | 83 | let exec: vscode.ProcessExecution | vscode.ShellExecution | undefined = undefined; |
84 | 84 | ||
85 | if (customRunner) { | 85 | if (customRunner) { |
86 | const runnerCommand = `${customRunner}.buildShellExecution`; | 86 | const runnerCommand = `${customRunner}.buildShellExecution`; |
@@ -105,13 +105,13 @@ export async function buildCargoTask( | |||
105 | 105 | ||
106 | if (!exec) { | 106 | if (!exec) { |
107 | // Check whether we must use a user-defined substitute for cargo. | 107 | // Check whether we must use a user-defined substitute for cargo. |
108 | const cargoCommand = definition.overrideCargo ? definition.overrideCargo : toolchain.cargoPath(); | 108 | // Split on spaces to allow overrides like "wrapper cargo". |
109 | const overrideCargo = definition.overrideCargo ?? definition.overrideCargo; | ||
110 | const cargoCommand = overrideCargo?.split(" ") ?? [toolchain.cargoPath()]; | ||
109 | 111 | ||
110 | // Prepare the whole command as one line. It is required if user has provided override command which contains spaces, | 112 | const fullCommand = [...cargoCommand, ...args]; |
111 | // for example "wrapper cargo". Without manual preparation the overridden command will be quoted and fail to execute. | ||
112 | const fullCommand = [cargoCommand, ...args].join(" "); | ||
113 | 113 | ||
114 | exec = new vscode.ShellExecution(fullCommand, definition); | 114 | exec = new vscode.ProcessExecution(fullCommand[0], fullCommand.slice(1), definition); |
115 | } | 115 | } |
116 | 116 | ||
117 | return new vscode.Task( | 117 | return new vscode.Task( |