Skip to content

Commit ff73dbf

Browse files
robcresswellbilliegoose
authored andcommitted
fix: sanitise pid parameter (#31)
This patch adds a simple check to the process ID passed in, ensuring it is a number, and throwing an error otherwise. The aim is to fix the issue explained here: - https://hackerone.com/reports/701183 - https://snyk.io/vuln/SNYK-JS-TREEKILL-536781 Fixes: #30
1 parent 3b5b8fe commit ff73dbf

File tree

1 file changed

+4
-0
lines changed

1 file changed

+4
-0
lines changed

index.js

+4
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,10 @@ var spawn = childProcess.spawn;
55
var exec = childProcess.exec;
66

77
module.exports = function (pid, signal, callback) {
8+
if (typeof pid !== "number") {
9+
throw new Error("pid must be a number");
10+
}
11+
812
var tree = {};
913
var pidsToProcess = {};
1014
tree[pid] = [];

0 commit comments

Comments
 (0)