Language: TypeScript
Label: safe
CWE: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Code:
    return { error: new Error('Not a valid commit hash') };
  }

  if (!isGit(thisPath)) {
    return {};
  }

  try {
    const { stdout } = execa.commandSync(`git --no-pager show ${thisCommit} --summary`, { cwd });

    const info = stdout
      .split('\n')
      .filter((entry) => entry.length !== 0);
    const mergeIndex = info[1]?.indexOf('Merge') === -1 ? 0 : 1;

    const hash = (new RegExp(regex).exec(info[0]) || [])[1];
    const shortHash = hash.slice(0, 7);

    const getInfo = (index: number): string | undefined => {
      const [, extractedInfo] = (new RegExp(regex).exec(info[index]) || []);

      return extractedInfo;
    };

    const author = (getInfo(1 + mergeIndex)?.match(/([^<]+)/) || [])[1]?.trim();
    const [, email] = getInfo(1 + mergeIndex)?.match(/<([^>]+)>/) || [];
    const date = getInfo(2 + mergeIndex);
    const message = stdout.split('\n\n')[1].trim();

    return {
      hash,
      shortHash,
      commit: hash,
      shortCommit: shortHash,
      author,
      email,
      date,
      message,
    };
  } catch (error) {
    return { error };
  }
};