diff options
Diffstat (limited to 'resources')
-rw-r--r-- | resources/resource_transformers/babel/babel.go | 12 | ||||
-rw-r--r-- | resources/resource_transformers/postcss/postcss.go | 14 |
2 files changed, 18 insertions, 8 deletions
diff --git a/resources/resource_transformers/babel/babel.go b/resources/resource_transformers/babel/babel.go index 64d8667bd..204153705 100644 --- a/resources/resource_transformers/babel/babel.go +++ b/resources/resource_transformers/babel/babel.go @@ -16,10 +16,11 @@ package babel import ( "bytes" "io" - "os/exec" "path/filepath" "strconv" + "github.com/cli/safeexec" + "github.com/gohugoio/hugo/common/hexec" "github.com/gohugoio/hugo/common/loggers" "github.com/gohugoio/hugo/common/hugo" @@ -108,10 +109,10 @@ func (t *babelTransformation) Transform(ctx *resources.ResourceTransformationCtx binary := csiBinPath - if _, err := exec.LookPath(binary); err != nil { + if _, err := safeexec.LookPath(binary); err != nil { // Try PATH binary = binaryName - if _, err := exec.LookPath(binary); err != nil { + if _, err := safeexec.LookPath(binary); err != nil { // This may be on a CI server etc. Will fall back to pre-built assets. return herrors.ErrFeatureNotAvailable } @@ -152,7 +153,10 @@ func (t *babelTransformation) Transform(ctx *resources.ResourceTransformationCtx } cmdArgs = append(cmdArgs, "--filename="+ctx.SourcePath) - cmd := exec.Command(binary, cmdArgs...) + cmd, err := hexec.SafeCommand(binary, cmdArgs...) + if err != nil { + return err + } cmd.Stdout = ctx.To cmd.Stderr = io.MultiWriter(infoW, &errBuf) diff --git a/resources/resource_transformers/postcss/postcss.go b/resources/resource_transformers/postcss/postcss.go index 27864b0c5..652770078 100644 --- a/resources/resource_transformers/postcss/postcss.go +++ b/resources/resource_transformers/postcss/postcss.go @@ -19,13 +19,16 @@ import ( "encoding/hex" "io" "io/ioutil" - "os/exec" "path" "path/filepath" "regexp" "strconv" "strings" + "github.com/cli/safeexec" + + "github.com/gohugoio/hugo/common/hexec" + "github.com/gohugoio/hugo/common/hugo" "github.com/gohugoio/hugo/common/loggers" @@ -146,10 +149,10 @@ func (t *postcssTransformation) Transform(ctx *resources.ResourceTransformationC binary := csiBinPath - if _, err := exec.LookPath(binary); err != nil { + if _, err := safeexec.LookPath(binary); err != nil { // Try PATH binary = binaryName - if _, err := exec.LookPath(binary); err != nil { + if _, err := safeexec.LookPath(binary); err != nil { // This may be on a CI server etc. Will fall back to pre-built assets. return herrors.ErrFeatureNotAvailable } @@ -186,7 +189,10 @@ func (t *postcssTransformation) Transform(ctx *resources.ResourceTransformationC cmdArgs = append(cmdArgs, optArgs...) } - cmd := exec.Command(binary, cmdArgs...) + cmd, err := hexec.SafeCommand(binary, cmdArgs...) + if err != nil { + return err + } var errBuf bytes.Buffer infoW := loggers.LoggerToWriterWithPrefix(logger.Info(), "postcss") |