v0.8 by selfint · Pull Request #190 · selfint/code-blocks

selfint · 2025-10-31T18:12:09Z

update all dependencies to latest versions
update CHANGELOG.md
update package version

Updated optional requirements and installation instructions for tree-sitter and node-gyp-build. Clarified that no tools are required for extension functionality.

src/Installer.ts

-        onData?.(d.toString())
+    logger.log(`Building parser ${parserName}`);
+    const buildResult = await runCmd(
+        `${npm} exec --yes --loglevel silly --prefix ${parsersDir} node-gyp rebuild --target=${process.versions.electron} --dist-url=https://electronjs.org/headers --runtime=electron`,


General fix:
Avoid passing any untrusted (or derived) data directly into a shell command string. Instead, use an argument array and a shell-less invocation with execFile, which does not invoke the shell and passes arguments as-is, eliminating the chance of command injection or accidental breakage due to whitespace or special characters.

Detailed fix:

Refactor the construction and invocation of the npm/node-gyp build command in downloadAndBuildParser so that it does not use string interpolation to produce a shell command string.

Instead, build an array of arguments and call execFile (or its promisified version) with shell: false.

Update the runCmd function so it can call execFile instead of exec when given arguments as an array.
(Alternatively, split the function, but the cleanest way is to use argument array + execFile.)

Pass path-like variables (such as ${parsersDir}) as arguments, not as part of a single command string.

Add any required imports (e.g., execFile from child_process).

Change the code path in downloadAndBuildParser (and the call to runCmd) to pass an array of arguments to ensure correct, injection-safe execution.

File/region/line specifics:

Edit src/Installer.ts:

Refactor the command creation at line 127.

Update runCmd to use execFile (or to differentiate between string/array commands).

Add any required imports.

selfint and others added 30 commits October 31, 2025 20:06

update all dependencies to latest versions

0f2b68b

update CHANGELOG.md

fcd206d

update package version

cba25cd

use node 20 in ci

1aba616

fix examples test harness

ef17459

speed up pr ci

037ca8f

try to fix examples ci

b359910

fix package ci step

183d067

speed up ci

fd8c533

Update examples [skip ci]

ae869d9

fix generate-example-asset script

f2536a0

Update examples [skip ci]

f5248d7

update package.json vscode engine version

d2a4fe8

update CHANGELOG.md

7c893a2

fix tree view example

8e5f483

improve type example util

f7b4ecd

refactor example util

83c2976

update block move rust match arms example

c397861

add apt update to ci

3fbe991

update CHANGELOG.md

ba0f891

speed up ci

76af932

Update examples [skip ci]

b72a09e

update block mode move rust match arms example

909de5b

Update examples [skip ci]

0ae4f9d

Fix Block_Mode_-_Move_-_Rust_-_Match_arms

4632ee5

Update examples [skip ci]

2ede068

Revise README for optional requirements and clarity

2cfdb80

Updated optional requirements and installation instructions for tree-sitter and node-gyp-build. Clarified that no tools are required for extension functionality.

Update README.md

e55977b

Use import instead of require in Installer (#192)

90370b9

update README.md

6399421

selfint and others added 5 commits November 4, 2025 10:31

Use npm to build parsers (#194)

3bd5d3b

update installer logs

f302e68

use node-gyp to build parsers for electron runtime

02bd502

use npm exec instead of npx

7d1a5c6

debug tree sitter parser builds

4c7df11

github-advanced-security bot found potential problems Nov 4, 2025

View reviewed changes

selfint added 8 commits November 4, 2025 21:11

add [latex] and [sql] npm packages

398b155

cleanup README and remove tree-sitter-cli from it

36d7da8

update 0.8.0 changelog

cfcad3b

Install tree-sitter on client on activate

513c895

remove debug code

9080c05

speed pr ci

f27453d

fix tree-sitter binary dependency

7ceeb57

fix tree-sitter binary dependency (retry 2)

7fb1d83

selfint merged commit a04cf9a into main Nov 8, 2025
13 checks passed

selfint deleted the v0.8 branch November 8, 2025 16:00

@@ -2,7 +2,7 @@
             import * as path from "path";
             import * as tar from "tar";
             import * as vscode from "vscode";
-            import { ExecException, ExecOptions, exec } from "child_process";
+            import { ExecException, ExecOptions, exec, execFile } from "child_process";
             import { Result, err, ok } from "./result";
             import { existsSync, rmSync } from "fs";
             import type { Language } from "tree-sitter";
@@ -124,7 +124,20 @@
                 // if it fails, try to build it
                 logger.log(`Building parser ${parserName}`);
                 const buildResult = await runCmd(
-                    `${npm} exec --yes --loglevel silly --prefix ${parsersDir} node-gyp rebuild --target=${process.versions.electron} --dist-url=https://electronjs.org/headers --runtime=electron`,
+                    [
+                        npm,
+                        "exec",
+                        "--yes",
+                        "--loglevel",
+                        "silly",
+                        "--prefix",
+                        parsersDir,
+                        "node-gyp",
+                        "rebuild",
+                        `--target=${process.versions.electron}`,
+                        "--dist-url=https://electronjs.org/headers",
+                        "--runtime=electron"
+                    ],
                     { cwd: parserDir },
                     (d) => onData?.(d.toString())
                 );
@@ -146,22 +159,39 @@
             }
             async function runCmd(
-                cmd: string,
+                cmd: string | string[],
                 options: ExecOptions = {},
                 onData?: (data: Buffer) => void
             ): Promise<Result<string, [ExecException, string[]]>> {
                 const logger = getLogger();
-                logger.log(`Running command: ${cmd}`);
+                logger.log(
+                    `Running command: ${
+                        Array.isArray(cmd) ? cmd.map(x => JSON.stringify(x)).join(' ') : cmd
+                    }`
+                );
                 const logs: string[] = [];
                 return await new Promise((resolve) => {
-                    const proc = exec(cmd, options, (error, stdout: string | Buffer, _stderr) => {
-                        if (error !== null) {
-                            resolve(err([error, logs]));
-                        } else {
-                            resolve(ok(stdout.toString()));
-                        }
-                    });
+                    let proc;
+                    if (Array.isArray(cmd)) {
+                        // The first element is the file, the rest are the arguments
+                        const [file, ...args] = cmd;
+                        proc = execFile(file, args, options, (error, stdout: string | Buffer, _stderr) => {
+                            if (error !== null) {
+                                resolve(err([error, logs]));
+                            } else {
+                                resolve(ok(stdout.toString()));
+                            }
+                        });
+                    } else {
+                        proc = exec(cmd, options, (error, stdout: string | Buffer, _stderr) => {
+                            if (error !== null) {
+                                resolve(err([error, logs]));
+                            } else {
+                                resolve(ok(stdout.toString()));
+                            }
+                        });
+                    }
                     if (onData !== undefined) {
                         proc.stdout?.on("data", onData);

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

v0.8#190

v0.8#190
selfint merged 43 commits intomainfrom
v0.8

selfint commented Oct 31, 2025

Uh oh!

Check warning

Copilot Autofix

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

selfint commented Oct 31, 2025

Uh oh!

Check warning

Uh oh!

Uh oh!

Copilot Autofix

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants