Merge pull request #164 from codecov/sanitize-gcov-options

[CE-1263] Sanitize gcov-args

Author: drazisil

lib/codecov.js

@@ -5,6 +5,7 @@ var urlgrey = require('urlgrey')
 var jsYaml = require('js-yaml')
 var walk = require('ignore-walk')
 var execSync = require('child_process').execSync
+var validator = require('validator')
 
 var detectProvider = require('./detect')
 
@@ -397,9 +398,9 @@ var upload = function(args, on_success, on_failure) {
           " -type f -name '*.gcno' " +
           gcg +
           ' -exec ' +
-          (args.options['gcov-exec'] || 'gcov') +
+          (validator.escape(args.options['gcov-exec']) || 'gcov') +
           ' ' +
-          (args.options['gcov-args'] || '') +
+          (validator.escape(args.options['gcov-args']) || '') +
           ' {} +'
       } else {
         // @TODO support for root

package-lock.json

@@ -35,7 +35,8 @@
     "ignore-walk": "^3.0.1",
     "js-yaml": "^3.13.1",
     "teeny-request": "^3.11.3",
-    "urlgrey": "^0.4.4"
+    "urlgrey": "^0.4.4",
+    "validator": "^12.1.0"
   },
   "devDependencies": {
     "eslint": "^5.16.0",