CVE-2022-24377: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: The package cycle-import-check before 1.3.2 are vulnerable to Command Injection via the writeFileToTmpDirAndOpenIt function due to improper user-input sanitization.
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 9.8
Published: 2022-12-14T05:15Z
Repository: https://github.com/Soontao/cycle-import-check
Language: TypeScript
Files changed: src/file.ts, src/index.ts
Commit date: 2022-11-16 21:35:02 +0800
Commit message: chore: dep update

Diff: diff --git a/src/file.ts b/src/file.ts
index 9d42912..518f71f 100644
--- a/src/file.ts
+++ b/src/file.ts
@@ -1,24 +1,18 @@
-import { Extension, ScanResult, ReportVO, PackageJson, FileImportDescription } from "./type";
+import { concat, filter, isArray, isString, join as arrayJoin, keys, map } from "@newdash/newdash";
+import { includes } from "@newdash/newdash/includes";
+import { readFileSync } from "fs";
 import { sync } from "glob";
-import { join as pathJoin, dirname, join, normalize, relative } from "path";
-import { join as arrayJoin, map, isArray, isString, concat, filter, keys } from "@newdash/newdash";
-import { includes } from "@newdash/newdash/includes"
-import { readFileSync, writeFileSync, existsSync } from "fs";
+import { dirname, join, join as pathJoin, normalize, relative } from "path";
 import { cwd } from "process";
-import { tmpdir, platform } from "os";
-import { exec } from "child_process";
+import { Extension, FileImportDescription, PackageJson, ReportVO, ScanResult } from "./type";
 
 require.extensions[".ts"] = require.extensions[".js"]
 require.extensions[".jsx"] = require.extensions[".js"]
 require.extensions[".tsx"] = require.extensions[".js"]
 require.extensions[".mjs"] = require.extensions[".js"]
 
-const extensions = [
-  "js", "jsx", "ts", "tsx", "mjs"
-]
-
 const { resolve } = require
 
 export const allDependencies = (absPath: string) => {
   return concatAllDependencies(findProjectPackageJson(absPath))
 }
@@ -118,14 +112,5 @@ export const mapScanResultToReportVO = (result: ScanResult): ReportVO => {
     value: i.code,
   }))
   return rt;
 }
 
-export const writeFileToTmpDirAndOpenIt = (filename: string, content: string) => {
-  const path = join(tmpdir(), filename);
-  writeFileSync(path, content);
-  if (platform() === "win32") {
-    exec(`start ${path}`)
-  } else {
-    exec(`open ${path}`)
-  }
-}
diff --git a/src/index.ts b/src/index.ts
index 719b401..8a396a6 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -1,8 +1,6 @@
 
 
 export { scanDirectoryWithResult } from "./scanner"
 
-export { writeFileToTmpDirAndOpenIt } from "./file"
-
 export { calculateCycleImport } from "./graph"
 

Vulnerable code: import { Extension, ScanResult, ReportVO, PackageJson, FileImportDescription } from "./type";
import { join as pathJoin, dirname, join, normalize, relative } from "path";
import { join as arrayJoin, map, isArray, isString, concat, filter, keys } from "@newdash/newdash";
import { includes } from "@newdash/newdash/includes"
import { readFileSync, writeFileSync, existsSync } from "fs";
import { tmpdir, platform } from "os";
import { exec } from "child_process";
const extensions = [
  "js", "jsx", "ts", "tsx", "mjs"
]

export const writeFileToTmpDirAndOpenIt = (filename: string, content: string) => {
  const path = join(tmpdir(), filename);
  writeFileSync(path, content);
  if (platform() === "win32") {
    exec(`start ${path}`)
  } else {
    exec(`open ${path}`)
  }
}
export { writeFileToTmpDirAndOpenIt } from "./file"

Fixed code: import { concat, filter, isArray, isString, join as arrayJoin, keys, map } from "@newdash/newdash";
import { includes } from "@newdash/newdash/includes";
import { readFileSync } from "fs";
import { dirname, join, join as pathJoin, normalize, relative } from "path";
import { Extension, FileImportDescription, PackageJson, ReportVO, ScanResult } from "./type";