CVE-2022-1440: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: Command Injection vulnerability in git-interface@2.1.1 in GitHub repository yarkeev/git-interface prior to 2.1.2. If both are provided by user input, then the use of a `--upload-pack` command-line argument feature of git is also supported for `git clone`, which would then allow for any operating system command to be spawned by the attacker.
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 9.8
Published: 2022-04-22T18:15Z
Repository: https://github.com/yarkeev/git-interface
Language: JSON
Files changed: package.json, src/index.ts
Commit date: 2022-04-21 22:42:41 +0300
Commit message: fix potential vulnerability with git clone

Diff: diff --git a/package.json b/package.json
index 649ac3b..f864781 100644
--- a/package.json
+++ b/package.json
@@ -1,17 +1,17 @@
 {
 	"name": "git-interface",
-	"version": "2.1.1",
+	"version": "2.1.2",
 	"description": "some interfaces for work with git repository",
 	"main": "dist/index",
 	"typings": "dist/index",
 	"scripts": {
 		"clean": "rm -rf ./dist",
 		"build": "npm run clean && npm run ts",
 		"dev": "npm run clean &&  ./node_modules/.bin/tsc -w",
 		"ts": "./node_modules/.bin/tsc",
-		"prepublish": "npm run build"
+		"prepublishOnly": "npm run build && bump"
 	},
 	"repository": {
 		"type": "git",
 		"url": "git://github.com/yarkeev/git-interface.git"
 	},
@@ -33,8 +33,9 @@
 		"url": "https://github.com/yarkeev/git-interface/issues"
 	},
 	"homepage": "https://github.com/yarkeev/git-interface",
 	"devDependencies": {
 		"@types/node": "^10.10.3",
-		"typescript": "^3.0.3"
+		"typescript": "^3.0.3",
+		"version-bump-prompt": "^6.1.0"
 	}
 }
diff --git a/src/index.ts b/src/index.ts
index 5236ced..7ca7b31 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -59,16 +59,14 @@ export class Git extends EventEmitter{
 	public setDir(dir: string) {
 		this.dir = dir;
 	}
 
 	public clone(repository: string, dest: string, options?: { depth?: number}) {
-
 		const opt = options || { depth: Infinity }
+		const depthOption = opt.depth !== Infinity ? `--depth=${opt.depth}` : '';
 
-		const depthOption = opt.depth !== Infinity ? ` --depth=${opt.depth}` : '';
-
-		return this.gitExec(`clone ${repository} ${dest}${depthOption}`);
+		return this.gitExec(`clone ${depthOption} -- ${repository} ${dest}`);
 	}
 
 	public checkout(branchName: string) {
 		return this.gitExec(`checkout ${branchName}`);
 	}
@@ -307,6 +305,6 @@ export class Git extends EventEmitter{
 				reject(err);
 			}
 		});
 	}
 
-}
\ No newline at end of file
+}

Vulnerable code: 	"version": "2.1.1",
		"prepublish": "npm run build"
		"typescript": "^3.0.3"

		const depthOption = opt.depth !== Infinity ? ` --depth=${opt.depth}` : '';

		return this.gitExec(`clone ${repository} ${dest}${depthOption}`);
}
Fixed code: 	"version": "2.1.2",
		"prepublishOnly": "npm run build && bump"
		"typescript": "^3.0.3",
		"version-bump-prompt": "^6.1.0"
		const depthOption = opt.depth !== Infinity ? `--depth=${opt.depth}` : '';
		return this.gitExec(`clone ${depthOption} -- ${repository} ${dest}`);
}