Security Fix for Command Injection - huntr.dev (#10644)

* Update getProcessForPort.js * Update getProcessForPort.js Co-authored-by: Zhou Peng <zpbrent@gmail.com> Co-authored-by: Dan Abramov <dan.abramov@gmail.com>
facebook · Mar 8, 2021 · f5e415f · f5e415f
1 parent 22f46a8
commit f5e415f
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/packages/react-dev-utils/getProcessForPort.js b/packages/react-dev-utils/getProcessForPort.js
@@ -9,6 +9,7 @@
 
 var chalk = require('chalk');
 var execSync = require('child_process').execSync;
+var execFileSync = require('child_process').execFileSync;
 var path = require('path');
 
 var execOptions = {
@@ -25,7 +26,7 @@ function isProcessAReactApp(processCommand) {
 }
 
 function getProcessIdOnPort(port) {
-  return execSync('lsof -i:' + port + ' -P -t -sTCP:LISTEN', execOptions)
+  return execFileSync('lsof', ['-i:' + port, '-P', '-t', '-sTCP:LISTEN'], execOptions)
     .split('\n')[0]
     .trim();
 }