Skip to content

Commit ab341fb

Browse files
committed
fix: use execFileSync for safer git command execution in lastModified date retrieval
1 parent d6a4f99 commit ab341fb

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

scripts/update-sitemap-dates.js

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -72,8 +72,8 @@ function getUrlToFileMap() {
7272
function getLastModifiedDate(filePath) {
7373
try {
7474
// Get the last commit date for the file
75-
const gitCommand = `git log -1 --format="%ai" -- "${filePath}"`
76-
const result = execSync(gitCommand, {
75+
// Use execFileSync to prevent command injection by separating command from arguments
76+
const result = execFileSync("git", ["log", "-1", "--format=%ai", "--", filePath], {
7777
cwd: path.join(__dirname, "../"), // Go to repo root
7878
encoding: "utf8",
7979
}).trim()

0 commit comments

Comments
 (0)