Merge pull request #107952 from justinsteven/bugfix/fix_CVE-2020-16881_…

…bypass Fix a bypass for CVE-2020-16881
microsoft · Oct 2, 2020 · a914a30 · a914a30
2 parents 247e5dc + 7c91cee
commit a914a30
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/extensions/npm/src/features/packageJSONContribution.ts b/extensions/npm/src/features/packageJSONContribution.ts
@@ -282,8 +282,8 @@ export class PackageJSONContribution implements IJSONContribution {
 
  private npmView(pack: string): Promise<ViewPackageInfo | undefined> {
  return new Promise((resolve, _reject) => {
- const command = 'npm view --json ' + pack + ' description dist-tags.latest homepage version';
- cp.exec(command, (error, stdout) => {
+ const args = ['view', '--json', pack, 'description', 'dist-tags.latest', 'homepage', 'version'];
+ cp.execFile('npm', args, (error, stdout) => {
  if (!error) {
  try {
  const content = JSON.parse(stdout);