nfischer/shelljs-exec-proxy

Unlimited shelljs commands with ES6 proxies

ShellJS Exec Proxy

Unleash the power of unlimited ShellJS commands... with ES6 Proxies!

Do you like ShellJS, but wish it had your favorite commands? Skip the weird exec() calls by using shelljs-exec-proxy:

// Our goal: make a commit: `$ git commit -am "I'm updating the \"foo\" module to be more secure"`
// Standard ShellJS requires the exec function, with confusing string escaping:
shell.exec('git commit -am "I\'m updating the \\"foo\\" module to be more secure"');
// Skip the extra string escaping with shelljs-exec-proxy!
shell.git.commit('-am', `I'm updating the "foo" module to be more secure`);

Installation

Important: This is only available for Node v6+ (it requires ES6 Proxies!)

$ npm install --save shelljs-exec-proxy

Get that JavaScript feeling back in your code

const shell = require('shelljs-exec-proxy');
shell.git.status();
shell.git.add('.');
shell.git.commit('-am', 'Fixed issue #1');
shell.git.push('origin', 'main');

Security improvements

Current versions of ShellJS export the .exec() method, which if not used carefully, could introduce command injection Vulnerabilities to your module. Here's an insecure code snippet:

shell.ls('dir/*.txt').forEach(file => {
  shell.exec('git add ' + file);
}

This leaves you vulnerable to files like:

Example file name	Unintended behavior
File 1.txt	This tries to add both File and 1.txt, instead of File 1.txt
foo;rm -rf *	This executes both git add foo and rm -rf *, unexpectedly deleting your files!
ThisHas"quotes'.txt	This tries running git add ThisHas"quotes'.txt, producing a Bash syntax error

shelljs-exec-proxy solves all these problems:

shell.ls('dir/*.txt').forEach(file => {
  shell.git.add(file);
}

Example file name	Behavior
File 1.txt	Arguments are automatically quoted, so spaces aren't an issue
foo;rm -rf *	Only one command runs at a time (semicolons are treated literally) and wildcards aren't expanded
ThisHas"quotes'.txt	Quote characters are automatically escaped for you, so there are never any issues

shelljs-exec-proxy's Issues

How to pass options or use callbacks?

shelljs-exec-proxy is awesome but I can't get this to work:

shell.curl('google.com', {silent:true});

or:

shell.curl('google.com', function(code, stdout, stderr) {
  console.log('Exit code:', code);
  console.log('Program output:', stdout);
  console.log('Program stderr:', stderr);
});

Are these possible, and if so, can you update the documentation with examples of how to call them? Thanx!

How to handle dynamic number of arguments?

Hi again,

I asked this on stackoverflow but didn't get an answer so thought it was worth asking here.

I'm using shelljs-exec-proxy with HandBrake and FFmpeg on Ubuntu, for example:

shell.ffmpeg( '-i', 'source/path', '-s','50x50', 'destination/path');

This works fine, however, before using shelljs-exec-proxy, the '-s','50x50', section was covered by a single parameter for the video file output settings e.g.:

var preset = '-s 50x50'
shell.exec(''ffmpeg -i' + 'source/path' +preset + 'destination/path');

The preset variable can have any number of arguments e.g.:

var preset = '-s 50x50 -ac 2'
shell.exec(''ffmpeg -i' + 'source/path' +preset + 'destination/path');

Is there a way for me to handle this with shelljs-exec-proxy? So I'd need one parameter to represent a bunch of arguments, something like this:

var arguments = '-s', '50x50', '-ac', '2'
shell.ffmpeg( '-i', 'source/path', arguments, 'destination/path');

exec: Unable to find a path to the node binary. Please manually set config.execPath

报这个exec: Unable to find a path to the node binary. Please manually set config.execPath 错误是什么原因？

Failing test on Windows (due to newline character)

See this test run: https://github.com/nfischer/shelljs-exec-proxy/actions/runs/7125051917

It looks like one of the tests broke on Windows. It looks like this is mismatch in the newline characters (\n vs. \r\n).

1) proxy
       subcommands
         runs very long subcommand chains:

      AssertionError: expected 'one two three four five six seven\n' to be 'one two three four five six seven\r\n'
      + expected - actual

Let CI cover up through Node 8

tr test case is skipped (need to support right-hand side of pipes)

I'm not sure why this test is skipped, it looks like it's been skipped since the initial commit. We can probably just enable it, but care should be taken to make sure it works.

non-existing prop warning

Hi,

I get a couple of non-existent property warnings (os x, bash).
Everything seems to work, so I am not sure if this is something to take care of...

Best
Ben

(node:2246) Warning: Accessing non-existent property 'cat' of module exports inside circular dependency (Use node --trace-warnings ...to show where the warning was created) (node:2246) Warning: Accessing non-existent property 'cd' of module exports inside circular dependency (node:2246) Warning: Accessing non-existent property 'chmod' of module exports inside circular dependency (node:2246) Warning: Accessing non-existent property 'cp' of module exports inside circular dependency (node:2246) Warning: Accessing non-existent property 'dirs' of module exports inside circular dependency (node:2246) Warning: Accessing non-existent property 'pushd' of module exports inside circular dependency (node:2246) Warning: Accessing non-existent property 'popd' of module exports inside circular dependency (node:2246) Warning: Accessing non-existent property 'echo' of module exports inside circular dependency (node:2246) Warning: Accessing non-existent property 'tempdir' of module exports inside circular dependency (node:2246) Warning: Accessing non-existent property 'pwd' of module exports inside circular dependency (node:2246) Warning: Accessing non-existent property 'exec' of module exports inside circular dependency (node:2246) Warning: Accessing non-existent property 'ls' of module exports inside circular dependency (node:2246) Warning: Accessing non-existent property 'find' of module exports inside circular dependency (node:2246) Warning: Accessing non-existent property 'grep' of module exports inside circular dependency (node:2246) Warning: Accessing non-existent property 'head' of module exports inside circular dependency (node:2246) Warning: Accessing non-existent property 'ln' of module exports inside circular dependency (node:2246) Warning: Accessing non-existent property 'mkdir' of module exports inside circular dependency (node:2246) Warning: Accessing non-existent property 'rm' of module exports inside circular dependency (node:2246) Warning: Accessing non-existent property 'mv' of module exports inside circular dependency (node:2246) Warning: Accessing non-existent property 'sed' of module exports inside circular dependency (node:2246) Warning: Accessing non-existent property 'set' of module exports inside circular dependency (node:2246) Warning: Accessing non-existent property 'sort' of module exports inside circular dependency (node:2246) Warning: Accessing non-existent property 'tail' of module exports inside circular dependency (node:2246) Warning: Accessing non-existent property 'test' of module exports inside circular dependency (node:2246) Warning: Accessing non-existent property 'to' of module exports inside circular dependency (node:2246) Warning: Accessing non-existent property 'toEnd' of module exports inside circular dependency (node:2246) Warning: Accessing non-existent property 'touch' of module exports inside circular dependency (node:2246) Warning: Accessing non-existent property 'uniq' of module exports inside circular dependency (node:2246) Warning: Accessing non-existent property 'which' of module exports inside circular dependency

Unable to run globally installed node modules via this module

I'm not sure if this is a bug or intentional, but I've noticed that adding double quotes around any globally installed node modules (e.g. "npm") causes node to try and access it from your working directory. This actually causes this module to break since all the arguments are quoted. I tested this with the latest LTS release of node, which as of now is v8.10.0. It would be nice if there was either an alternate way to run these modules with this exec proxy or make a quick patch to allow this functionality with a small sacrifice to security.

Update to use new exec-alternative API

To eliminate all security holes and get a consistent cross-platform API, this should migrate to ShellJS's exec-replacement after the next release (implementation can start once it has been merged).

Increase timeout for "handles unsafe filenames"

This test takes about 1950ms on my machine, which gets very close to the 2000ms timeout. We can increase the timeout to something safer, like 5000.

Set up CI for Windows

I believe I've configured Appveyor to cover Windows, but the test suite is not currently passing. Getting the tests passing should be considered a prerequisite for using this module in production on Windows clients.