Shell-quote is a lightweight npm package designed for parsing and quoting shell commands, offering developers a straightforward solution for manipulating command-line strings. The package is available under the MIT license, promoting open use and modification. Examining versions 0.0.0 and 0.0.1 reveals minimal core changes beyond a version number increment. Both versions share the same foundational description and functionality for quoting and parsing shell commands. The developer dependencies remain consistent, with "tap" at version "~0.2.5" used for testing purposes.
The key difference lies in the version number itself and the release timestamps. Version 0.0.0 was released earlier on May 18, 2012, at 10:42:06 GMT, while version 0.0.1 followed later the same day at 18:25:42 GMT. This suggests a minor update or bug fix prompted the quick release of the subsequent version. For developers, this increment signifies potential stability improvements or resolutions to initial issues identified in version 0.0.0. While the code base appears largely unchanged based on the provided metadata, it's advisable to opt for version 0.0.1 for access to the most current, potentially refined iteration of the shell-quote tool. The package, authored by James Halliday, can be readily installed via npm using the 'shell-quote' package name.
All the vulnerabilities related to the version 0.0.1 of the package
Potential Command Injection in shell-quote
Affected versions of shell-quote do not properly escape command line arguments, which may result in command injection if the library is used to escape user input destined for use as command line arguments.
The following characters are not escaped properly: >,;,{,}
Bash has a neat but not well known feature known as "Bash Brace Expansion", wherein a sub-command can be executed without spaces by running it between a set of {} and using the , instead of to seperate arguments. Because of this, full command injection is possible even though it was initially thought to be impossible.
const quote = require('shell-quote').quote;
console.log(quote(['a;{echo,test,123,234}']));
// Actual "a;{echo,test,123,234}"
// Expected "a\;\{echo,test,123,234\}"
// Functional Equivalent "a; echo 'test' '123' '1234'"
Update to version 1.6.1 or later.