Skip to content

Commit 8cec8fe

Browse files
authored
Replace use of execSync with spawnSync in @react-native-windows/automation (#14434)
## Description This PR updates the use of `execSync` to `spawnSync` in `@react-native-windows/automation` to avoid potential security vulnerabilities. ### Type of Change - Bug fix (non-breaking change which fixes an issue) ### Why There is a CodeQL alert that we're using shell commands unsafely in the automation library to get the name of an appx and then launch it for unit tests. Closes #14242 ### What Rather than using `execSync`, which is unsafe, we are now using `spawnSync` to execute shell commands in a safer manner. ## Screenshots N/A ## Testing I verified that our existing E2E test apps still launch and run as expected with this change. ## Changelog Should this change be included in the release notes: _yes_ Replace use of `execSync` with `spawnSync` in `@react-native-windows/automation`
1 parent 3c85fce commit 8cec8fe

File tree

2 files changed

+17
-6
lines changed

2 files changed

+17
-6
lines changed
Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
{
2+
"type": "patch",
3+
"comment": "Replace use of `execSync` with `spawnSync` in `@react-native-windows/automation`",
4+
"packageName": "@react-native-windows/automation",
5+
"email": "jthysell@microsoft.com",
6+
"dependentChangeType": "patch"
7+
}

packages/@react-native-windows/automation/src/AutomationEnvironment.ts

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
*/
77

88
import chalk from 'chalk';
9-
import {execSync, spawn, ChildProcess} from 'child_process';
9+
import {spawnSync, spawn, ChildProcess} from 'child_process';
1010
import fs from '@react-native-windows/fs';
1111
import path from 'path';
1212
import readlineSync from 'readline-sync';
@@ -199,7 +199,11 @@ export default class AutomationEnvironment extends NodeEnvironment {
199199

200200
if (this.rootLaunchApp) {
201201
const appPackageName = resolveAppName(appName);
202-
execSync(`start shell:AppsFolder\\${appPackageName}`);
202+
spawnSync('cmd', [
203+
'/c',
204+
'start',
205+
`shell:AppsFolder\\${appPackageName}`,
206+
]);
203207
}
204208

205209
// Set up the "Desktop" or Root session
@@ -323,10 +327,10 @@ function resolveAppName(appName: string): string {
323327
}
324328

325329
try {
326-
const packageFamilyName = execSync(
327-
`powershell (Get-AppxPackage -Name ${appName}).PackageFamilyName`,
328-
)
329-
.toString()
330+
const packageFamilyName = spawnSync('powershell', [
331+
`(Get-AppxPackage -Name ${appName}).PackageFamilyName`,
332+
])
333+
.stdout.toString()
330334
.trim();
331335

332336
if (packageFamilyName.length === 0) {

0 commit comments

Comments
 (0)