check if there is a forbidden character in commandName

mathisonian · Oct 12, 2018 · 4af96dc · 4af96dc
1 parent db45a2f
commit 4af96dc
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/lib/command-exists.js b/lib/command-exists.js
@@ -62,6 +62,10 @@ var commandExistsUnix = function(commandName, cleanedCommandName, callback) {
 }
 
 var commandExistsWindows = function(commandName, cleanedCommandName, callback) {
+  if (/[\x00-\x1f<>:"\|\?\*]/.test(commandName)) {
+    callback(null, false);
+    return;
+  }
   var child = exec('where ' + cleanedCommandName,
     function (error) {
       if (error !== null){
@@ -89,6 +93,9 @@ var commandExistsUnixSync = function(commandName, cleanedCommandName) {
 }
 
 var commandExistsWindowsSync = function(commandName, cleanedCommandName, callback) {
+  if (/[\x00-\x1f<>:"\|\?\*]/.test(commandName)) {
+    return false;
+  }
   try {
       var stdout = execSync('where ' + cleanedCommandName, {stdio: []});
       return !!stdout;