Potentional security flaw

[Gottox]

git-wrapper should never ever be used with unchecked values. It's currently not safe for productive usage and apparently was never intended for such a case. The way the arguments are converted to command line is insanely stupid:

var cmd = this.binary + ' ' + this.args + ' ' + command + ' ' + options + ' '
+ args

None of these arguments are checked for shell code or escaped in any way.

So try the following:

node -e 'var g=new (require("git-wrapper"))(".");g.args=";echo ABC";g.exec(";echo DEF", [";echo GHI"], function(e,m){console.log(m)})'

To fix this, you never ever should use exec but spawn instead

[pvorb]

Well, you always can inject something into your own code.

But thank you for mentioning it. I'll fix it, once I have the time.

[JamieSlome]

Please see the suggested fix - https://github.com/pvorb/node-git-wrapper/pull/10. Thanks! 🍰

[adelriosantiago]

@pvorb Any chance on getting the PR above approved? Otherwise could I become a collaborator of this project? Thanks!