Shell-quote is a lightweight npm package designed for parsing and quoting shell commands within Node.js environments. Versions 1.3.0 and 1.3.1, though seemingly similar, offer subtle distinctions that developers should note. Both versions share the core functionality of enabling developers to manipulate shell commands programmatically, handling complexities like escaping special characters and splitting command strings into manageable parts. They use the MIT license, ensuring freedom for integration into various projects. The packages are also both authored by James Halliday and maintain the same repository.
The key difference lies in the release date. Version 1.3.1 was released shortly after 1.3.0, suggesting a minor update or bug fix. While the changelog isn't provided, this quick succession typically indicates a small adjustment. For projects already using shell-quote, upgrading from 1.3.0 to 1.3.1 is generally recommended, as it likely incorporates improvements or fixes. Developers initiating new projects should opt for the latest version (1.3.1) to benefit from these potential enhancements. It's advisable to consult the project's GitHub repository for detailed release notes to understand the exact nature of the changes between the two versions and assess their impact on specific use cases.
All the vulnerabilities related to the version 1.3.1 of the package
Potential Command Injection in shell-quote
Affected versions of shell-quote do not properly escape command line arguments, which may result in command injection if the library is used to escape user input destined for use as command line arguments.
The following characters are not escaped properly: >,;,{,}
Bash has a neat but not well known feature known as "Bash Brace Expansion", wherein a sub-command can be executed without spaces by running it between a set of {} and using the , instead of to seperate arguments. Because of this, full command injection is possible even though it was initially thought to be impossible.
const quote = require('shell-quote').quote;
console.log(quote(['a;{echo,test,123,234}']));
// Actual "a;{echo,test,123,234}"
// Expected "a\;\{echo,test,123,234\}"
// Functional Equivalent "a; echo 'test' '123' '1234'"
Update to version 1.6.1 or later.