Skip to content

feat: Account for Node security patch #1778

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
erisu merged 4 commits into from
Feb 18, 2025
Merged

feat: Account for Node security patch #1778

Changes from 3 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
f98c708
Account for Node security patch
kant2002 Feb 10, 2025
859c2ce
Update lib/check_reqs.js
kant2002 Feb 11, 2025
a247df7
Fix incorrect parameter
kant2002 Feb 11, 2025
431497d
Address PR comments. Normalize comment with option in the code below.
kant2002 Feb 11, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion lib/check_reqs.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -110,7 +110,9 @@ module.exports.get_gradle_wrapper = function () {
let program_dir;
// OK, This hack only works on Windows, not on Mac OS or Linux. We will be deleting this eventually!
if (module.exports.isWindows()) {
const result = execa.sync(path.join(__dirname, 'getASPath.bat'));
// "spawn" option enabled for CVE-2024-27980 (Windows) Mitigation
Copy link
Contributor

@breautek breautek Feb 11, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
// "spawn" option enabled for CVE-2024-27980 (Windows) Mitigation
// "shell" option enabled for CVE-2024-27980 (Windows) Mitigation

I wrote in "spawn" because that was in the original PR but since we determine the "shell" option is correct, that should be reflected in the comment too.

// See https://nodejs.org/en/blog/vulnerability/april-2024-security-releases-2 for more details
const result = execa.sync(path.join(__dirname, 'getASPath.bat'), { shell: true });
// console.log('result.stdout =' + result.stdout.toString());
// console.log('result.stderr =' + result.stderr.toString());

Expand Down