Skip to content

Commit

Permalink
Prevent launching node.js script file in working directory.
Browse files Browse the repository at this point in the history
The PATHEXT environment variable on Windows often includes .JS, which means running "node" can try to execute a file named "node.js" in the current working directory. As npm-installed executable scripts are often executed in directories containing .js files, this is not unlikely.

This change works around it by locally stripping the .JS extension from the PATHEXT environment variable.
  • Loading branch information
bwrrp committed May 14, 2014
1 parent dd944dd commit 8b1433c
Show file tree
Hide file tree
Showing 2 changed files with 12 additions and 0 deletions.
4 changes: 4 additions & 0 deletions index.js
Original file line number Diff line number Diff line change
Expand Up @@ -99,13 +99,17 @@ function writeShim_ (from, to, prog, args, cb) {
// @IF EXIST "%~dp0\node.exe" (
// "%~dp0\node.exe" "%~dp0\.\node_modules\npm\bin\npm-cli.js" %*
// ) ELSE (
// SETLOCAL
// SET PATHEXT=%PATHEXT:;.JS;=;%
// node "%~dp0\.\node_modules\npm\bin\npm-cli.js" %*
// )
var cmd
if (longProg) {
cmd = "@IF EXIST " + longProg + " (\r\n"
+ " " + longProg + " " + args + " " + target + " %*\r\n"
+ ") ELSE (\r\n"
+ " @SETLOCAL\r\n"
+ " @SET PATHEXT=%PATHEXT:;.JS;=;%\r\n"
+ " " + prog + " " + args + " " + target + " %*\r\n"
+ ")"
} else {
Expand Down
8 changes: 8 additions & 0 deletions test/basic.js
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,8 @@ test('env shebang', function (t) {
"@IF EXIST \"%~dp0\\node.exe\" (\r"+
"\n \"%~dp0\\node.exe\" \"%~dp0\\from.env\" %*\r"+
"\n) ELSE (\r"+
"\n @SETLOCAL\r"+
"\n @SET PATHEXT=%PATHEXT:;.JS;=;%\r"+
"\n node \"%~dp0\\from.env\" %*\r"+
"\n)")
t.end()
Expand Down Expand Up @@ -86,6 +88,8 @@ test('env shebang with args', function (t) {
"@IF EXIST \"%~dp0\\node.exe\" (\r"+
"\n \"%~dp0\\node.exe\" --expose_gc \"%~dp0\\from.env.args\" %*\r"+
"\n) ELSE (\r"+
"\n @SETLOCAL\r"+
"\n @SET PATHEXT=%PATHEXT:;.JS;=;%\r"+
"\n node --expose_gc \"%~dp0\\from.env.args\" %*\r"+
"\n)")
t.end()
Expand Down Expand Up @@ -123,6 +127,8 @@ test('explicit shebang', function (t) {
"@IF EXIST \"%~dp0\\/usr/bin/sh.exe\" (\r" +
"\n \"%~dp0\\/usr/bin/sh.exe\" \"%~dp0\\from.sh\" %*\r" +
"\n) ELSE (\r" +
"\n @SETLOCAL\r"+
"\n @SET PATHEXT=%PATHEXT:;.JS;=;%\r"+
"\n /usr/bin/sh \"%~dp0\\from.sh\" %*\r" +
"\n)")
t.end()
Expand Down Expand Up @@ -160,6 +166,8 @@ test('explicit shebang with args', function (t) {
"@IF EXIST \"%~dp0\\/usr/bin/sh.exe\" (\r" +
"\n \"%~dp0\\/usr/bin/sh.exe\" -x \"%~dp0\\from.sh.args\" %*\r" +
"\n) ELSE (\r" +
"\n @SETLOCAL\r"+
"\n @SET PATHEXT=%PATHEXT:;.JS;=;%\r"+
"\n /usr/bin/sh -x \"%~dp0\\from.sh.args\" %*\r" +
"\n)")
t.end()
Expand Down

0 comments on commit 8b1433c

Please sign in to comment.