Spinner refactor #2238
Spinner refactor #2238
Conversation
…edTokens to generateStyles INSTUI-4846
remove require path, because it was used to import from the deprecated 'canvas-theme', 'canvar-high-contrast-theme' packages remove functional theme support, it was used only for Avatar useStyle no longer needs generateComponentTheme since this is not used by new themes
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
|
||
| function bootstrap() { | ||
| execSync(path.resolve('scripts/clean.js'), opts) |
Check warning
Code scanning / CodeQL
Shell command built from environment values Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 6 days ago
The fix is to avoid executing arbitrary shell commands built from dynamic path values via execSync. Instead, launch Node directly on the target script using execFileSync, passing the script path as an argument — this prevents shell expansion issues, avoids interpretation of spaces and special shell characters, and aligns with best practices. Specifically:
-
On line 68, in the
bootstrapfunction, replaceexecSync(path.resolve('scripts/clean.js'), opts)withexecFileSync(process.execPath, [path.resolve('scripts/clean.js')], opts). This runs the script under the Node interpreter rather than launching the script itself as a shell command. -
Import
execFileSyncfromchild_process. -
Optionally remove unused imports if needed (keep other code unchanged).
All changes are limited to the shown code in scripts/bootstrap.js.
| @@ -24,7 +24,7 @@ | ||
| * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE | ||
| * SOFTWARE. | ||
| */ | ||
| const { execSync, fork } = require('child_process') | ||
| const { execSync, execFileSync, fork } = require('child_process') | ||
| const path = require('path') | ||
|
|
||
| const opts = { stdio: 'inherit' } | ||
| @@ -65,7 +65,7 @@ | ||
| } | ||
|
|
||
| function bootstrap() { | ||
| execSync(path.resolve('scripts/clean.js'), opts) | ||
| execFileSync(process.execPath, [path.resolve('scripts/clean.js')], opts) | ||
| buildProject() | ||
| } | ||
|
|
|
No description provided.