Skip to content

Conversation

@amanabiy
Copy link
Member

Description

Related links, issue #, if available: n/a

How has this been tested?

Review checklist

The following items are to be evaluated by the author(s) and the reviewer(s).

Correctness

  • Changes include appropriate documentation updates.
  • Changes are backward-compatible if not indicated, see CONTRIBUTING.md.
  • Changes do not include unsupported browser features, see CONTRIBUTING.md.
  • Changes were manually tested for accessibility, see accessibility guidelines.

Security

Testing

  • Changes are covered with new/existing unit tests?
  • Changes are covered with new/existing integration tests?

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

@codecov
Copy link

codecov bot commented Dec 30, 2025

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.15%. Comparing base (0f8232f) to head (112b41b).

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #4136   +/-   ##
=======================================
  Coverage   97.15%   97.15%           
=======================================
  Files         878      878           
  Lines       25716    25716           
  Branches     9297     9297           
=======================================
  Hits        24985    24985           
  Misses        725      725           
  Partials        6        6           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@amanabiy amanabiy force-pushed the dev-v3-amanabiy-pages branch from 8b1eafe to 112b41b Compare January 16, 2026 15:26

function execCommand(command, options = {}) {
try {
execSync(command, { stdio: 'inherit', ...options });

Check warning

Code scanning / CodeQL

Shell command built from environment values Medium

This shell command depends on an uncontrolled
absolute path
.

Copilot Autofix

AI 1 day ago

Generally, the problem is fixed by avoiding concatenating environment-derived values into a shell command string executed via a shell. Instead, call the program directly and pass arguments as an array using child_process.execFileSync or spawnSync, so the shell doesn’t reinterpret special characters. If dynamic construction is unavoidable, inputs must be safely escaped—but that is error-prone and unnecessary here.

In this specific file, we should:

  • Replace execSync(command, ...) with execFileSync using a command binary and an arguments array.
  • Stop passing full shell command strings like mkdir -p ${copyBuildToolsPath} into execCommand. Instead, call execCommand with a command name and a list of arguments, e.g. execCommand('mkdir', ['-p', copyBuildToolsPath]).
  • Update execCommand to accept (cmd, args = [], options = {}), log a human-readable representation, and pass those directly to execFileSync.
  • Keep functionality identical: still run mkdir -p <path>, rm -rf <path>, and git clone --branch ... with the same options and error logging.

Concretely in scripts/setup-build-tools.js:

  • Add execFileSync to the import from child_process.
  • Change the three top-level execCommand calls on lines 17–19 to use (command, args) instead of a single string.
  • Rewrite execCommand on lines 23–33 accordingly, and update error messages to print the reconstructed command string for readability.
Suggested changeset 1
scripts/setup-build-tools.js

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/scripts/setup-build-tools.js b/scripts/setup-build-tools.js
--- a/scripts/setup-build-tools.js
+++ b/scripts/setup-build-tools.js
@@ -6,7 +6,7 @@
 // "postinstall": "node ./scripts/install-peer-dependency.js collection-hooks:property-filter-token-groups"
 // where "collection-hooks" is the package to fetch and "property-filter-token-groups" is the branch name in GitHub.
 
-import { execSync } from 'child_process';
+import { execFileSync } from 'child_process';
 import process from 'node:process';
 import path from 'path';
 
@@ -14,17 +14,18 @@
 const packageName = 'build-tools';
 const targetRepository = `https://github.com/cloudscape-design/${packageName}.git`;
 const copyBuildToolsPath = path.join(process.cwd(), 'shared', 'build-tools');
-execCommand(`mkdir -p ${copyBuildToolsPath}`);
-execCommand(`rm -rf ${copyBuildToolsPath}`);
-execCommand(`git clone --branch ${branch} --single-branch ${targetRepository} ${copyBuildToolsPath}`);
+execCommand('mkdir', ['-p', copyBuildToolsPath]);
+execCommand('rm', ['-rf', copyBuildToolsPath]);
+execCommand('git', ['clone', '--branch', branch, '--single-branch', targetRepository, copyBuildToolsPath]);
 
 console.log(`build-tools has been successfully installed!`);
 
-function execCommand(command, options = {}) {
+function execCommand(command, args = [], options = {}) {
   try {
-    execSync(command, { stdio: 'inherit', ...options });
+    execFileSync(command, args, { stdio: 'inherit', ...options });
   } catch (error) {
-    console.error(`Error executing command: ${command}`);
+    const commandString = [command, ...args].join(' ');
+    console.error(`Error executing command: ${commandString}`);
     console.error(`Error message: ${error.message}`);
     console.error(`Stdout: ${error.stdout && error.stdout.toString()}`);
     console.error(`Stderr: ${error.stderr && error.stderr.toString()}`);
EOF
@@ -6,7 +6,7 @@
// "postinstall": "node ./scripts/install-peer-dependency.js collection-hooks:property-filter-token-groups"
// where "collection-hooks" is the package to fetch and "property-filter-token-groups" is the branch name in GitHub.

import { execSync } from 'child_process';
import { execFileSync } from 'child_process';
import process from 'node:process';
import path from 'path';

@@ -14,17 +14,18 @@
const packageName = 'build-tools';
const targetRepository = `https://github.com/cloudscape-design/${packageName}.git`;
const copyBuildToolsPath = path.join(process.cwd(), 'shared', 'build-tools');
execCommand(`mkdir -p ${copyBuildToolsPath}`);
execCommand(`rm -rf ${copyBuildToolsPath}`);
execCommand(`git clone --branch ${branch} --single-branch ${targetRepository} ${copyBuildToolsPath}`);
execCommand('mkdir', ['-p', copyBuildToolsPath]);
execCommand('rm', ['-rf', copyBuildToolsPath]);
execCommand('git', ['clone', '--branch', branch, '--single-branch', targetRepository, copyBuildToolsPath]);

console.log(`build-tools has been successfully installed!`);

function execCommand(command, options = {}) {
function execCommand(command, args = [], options = {}) {
try {
execSync(command, { stdio: 'inherit', ...options });
execFileSync(command, args, { stdio: 'inherit', ...options });
} catch (error) {
console.error(`Error executing command: ${command}`);
const commandString = [command, ...args].join(' ');
console.error(`Error executing command: ${commandString}`);
console.error(`Error message: ${error.message}`);
console.error(`Stdout: ${error.stdout && error.stdout.toString()}`);
console.error(`Stderr: ${error.stderr && error.stderr.toString()}`);
Copilot is powered by AI and may make mistakes. Always verify output.
// SPDX-License-Identifier: Apache-2.0

// Can be used in postinstall script like so:
// "postinstall": "node ./scripts/install-peer-dependency.js collection-hooks:property-filter-token-groups"
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this description is a leftover, I believe we don't need any for this script as all

const copyBuildToolsPath = path.join(process.cwd(), 'shared', 'build-tools');
execCommand(`mkdir -p ${copyBuildToolsPath}`);
execCommand(`rm -rf ${copyBuildToolsPath}`);
execCommand(`git clone --branch ${branch} --single-branch ${targetRepository} ${copyBuildToolsPath}`);
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For such a simple command - can we inline that in the package.json?

E.g. "rimraf shared/build-tools && mkdir -p shared/build-tools && git clone --branch add-test-pages-util-permutation-view --single-branch https://github.com/cloudscape-design/build-tools.git shared/build-tools"

<PermutationsView permutations={permutations} render={permutation => <Alert {...permutation} />} />
<PermutationsView
permutations={permutations}
render={(permutation: AlertProps) => <Alert {...permutation} />}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why the param is explicitly annotated here - it is necessary?

"@babel/plugin-syntax-typescript": "^7.23.3",
"@cloudscape-design/browser-test-tools": "^3.0.0",
"@cloudscape-design/build-tools": "github:cloudscape-design/build-tools#main",
"@cloudscape-design/build-tools-repo": "github:cloudscape-design/build-tools#add-test-pages-util-permutation-view",
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

what is @cloudscape-design/build-tools-repo for?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants