Commit 83e38fa
fix node-pre-gyp spawn on windows with node 18+
spawning cmd files without shell: true wasn't really allowed before, but not it's expressly disallowed because of a recent vulnerability reported to node1 parent 476d81f commit 83e38fa
1 file changed
Lines changed: 6 additions & 4 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -26,11 +26,13 @@ module.exports = function install() { | |||
| 26 | 26 | } | |
| 27 | 27 | ||
| 28 | 28 | return new Promise(function(resolve, reject) { | |
| 29 | + const gypPath = path.join(__dirname, "..", "node_modules", "node-gyp", "bin", "node-gyp.js"); | ||
| 29 | 30 | var spawnedNodePreGyp = spawn(nodePreGyp, args, { | |
| 30 | - env: Object.assign({}, process.env, { | ||
| 31 | - npm_config_node_gyp: path.join(__dirname, "..", "node_modules", | ||
| 32 | - "node-gyp", "bin", "node-gyp.js") | ||
| 33 | - }) | ||
| 31 | + env: { | ||
| 32 | + ...process.env, | ||
| 33 | + npm_config_node_gyp: gypPath | ||
| 34 | + }, | ||
| 35 | + shell: process.platform === "win32" | ||
| 34 | 36 | }); | |
| 35 | 37 | ||
| 36 | 38 | spawnedNodePreGyp.stdout.on("data", function(data) { | |
0 commit comments