Language: TypeScript
Label: safe
CWE: CWE-88 \u2014 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
The product constructs a string for a command to be executed by a separate component
in another control sphere, but it does not properly delimit the
intended arguments, options, or switches within that command string.

Code:
export async function git(path: string): Promise<BlameResult> {
  const blamedLines: { [line: string]: BlamedLine } = {};
  const pathToGit: string = await which('git');

  if (!existsSync(path)) {
    throw new Error(`File ${path} does not exist`);
  }

  const result = execa.sync(pathToGit, ['blame', '-w', path]);
  result.stdout.split('\n').forEach(line => {
    if (line !== '') {
      const blamedLine = convertStringToObject(line);
      if (blamedLine.line) {
        blamedLines[blamedLine.line] = blamedLine;
      }
    }
  });
  return {
    [path]: blamedLines
  };
}