Skip to content

fix(powershell): don't use Invoke-Expression if ExpectingInput #8303

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 8 commits into from

Conversation

alexsch01
Copy link
Contributor

@alexsch01 alexsch01 commented May 16, 2025

dang, my apologies for getting this out after the npm release

this prevents a performance/security regression with piping strings into npm/npx

This should block nodejs/node#58347


echo "Hello" | npm help a=1,b=2,c=3
No matches in help for: a=1 b=2 c=3

npm help a=1,b=2,c=3
No matches in help for: a=1,b=2,c=3

This is the best compromise between convenience and security

@alexsch01
Copy link
Contributor Author

alexsch01 commented May 20, 2025

Would be great to make it into 11.4.1
@owlstronaut @wraithgar

@alexsch01 alexsch01 mentioned this pull request May 21, 2025
@alexsch01
Copy link
Contributor Author

I was going to add a warning for the $ExpectingInput case when the $args variable contains an array as an element
but it doesn't cover the case of echo hello | npm start -- --arg1 --arg2, so I removed the warning

@alexsch01 alexsch01 marked this pull request as draft May 21, 2025 21:51
@alexsch01
Copy link
Contributor Author

Converting to a draft because it's missing some features

@alexsch01 alexsch01 deleted the branch npm:latest May 22, 2025 12:56
@alexsch01 alexsch01 closed this May 22, 2025
@alexsch01 alexsch01 deleted the latest branch May 22, 2025 12:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant