Shell-quote is a valuable npm package designed for developers needing to parse and quote shell commands directly within their JavaScript applications. Versions 1.3.1 and 1.3.2 share a common foundation, both offering robust functionality for manipulating shell commands. The core features, such as quoting and parsing capabilities, along with the MIT license and author information, remain consistent between versions. Both rely on the same development dependencies of tap (~0.4.2) and tape (~1.0.2) for testing.
However, the key difference lies in the release date. Version 1.3.1 was released on May 13, 2013, while version 1.3.2 followed shortly after, on June 24, 2013. This suggests that version 1.3.2 likely includes bug fixes, minor enhancements, or subtle improvements over its predecessor. While the specific nature of these changes isn't explicitly detailed in the provided data, the proximity of the release dates implies that the update was likely addressing immediate issues or refinements identified after the initial release of 1.3.1. For developers, especially those using shell-quote in production environments, upgrading to the newer 1.3.2 is recommended to benefit from any potential stability enhancements or bug resolutions it offers. By upgrading you are more likely to use the most solid version of the tool.
All the vulnerabilities related to the version 1.3.2 of the package
Potential Command Injection in shell-quote
Affected versions of shell-quote do not properly escape command line arguments, which may result in command injection if the library is used to escape user input destined for use as command line arguments.
The following characters are not escaped properly: >,;,{,}
Bash has a neat but not well known feature known as "Bash Brace Expansion", wherein a sub-command can be executed without spaces by running it between a set of {} and using the , instead of to seperate arguments. Because of this, full command injection is possible even though it was initially thought to be impossible.
const quote = require('shell-quote').quote;
console.log(quote(['a;{echo,test,123,234}']));
// Actual "a;{echo,test,123,234}"
// Expected "a\;\{echo,test,123,234\}"
// Functional Equivalent "a; echo 'test' '123' '1234'"
Update to version 1.6.1 or later.