work around cloning repos #28
Conversation
…t dir, and extracting from the folder
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| await removePreviousClone(path) | ||
|
|
||
| return new Promise<string>((resolve, reject) => { | ||
| const child = spawn('git', ['clone', info.href, path]) |
Check failure
Code scanning / CodeQL
Second order command injection High
There was a problem hiding this comment.
I'm going to try and commit a change to see if I can fix this
There was a problem hiding this comment.
Well, looks like my test didn't help. I think they are suggesting checking for a valid remote and I thought checking for "upload-pack" would work.
https://codeql.github.com/codeql-query-help/javascript/js-second-order-command-line-injection/
There was a problem hiding this comment.
Hmm, I wonder if there is a way to ignore that error line or file... Unless it's necessary, then I don't mind adding checks. CodeQL can get in the way sometimes.
|
Superseded by #29 |
cleaning previous downloads, removing .git dir, and extracting from the cloned folder