Security Fix for Command Injection - huntr.dev (facebook#10644)

* Update getProcessForPort.js * Update getProcessForPort.js Co-authored-by: Zhou Peng <zpbrent@gmail.com> Co-authored-by: Dan Abramov <dan.abramov@gmail.com>
akxcv · Apr 28, 2021 · d70d014 · d70d014
1 parent bdc5381
commit d70d014
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/packages/react-dev-utils/getProcessForPort.js b/packages/react-dev-utils/getProcessForPort.js
@@ -9,6 +9,7 @@
 
 var chalk = require('chalk');
 var execSync = require('child_process').execSync;
+var execFileSync = require('child_process').execFileSync;
 var path = require('path');
 
 var execOptions = {
@@ -25,7 +26,7 @@ function isProcessAReactApp(processCommand) {
 }
 
 function getProcessIdOnPort(port) {
-  return execSync('lsof -i:' + port + ' -P -t -sTCP:LISTEN', execOptions)
+  return execFileSync('lsof', ['-i:' + port, '-P', '-t', '-sTCP:LISTEN'], execOptions)
     .split('\n')[0]
     .trim();
 }