(fileName: string, line1: number, column1: number)
| 317 | } |
| 318 | |
| 319 | export function launchEditor(fileName: string, line1: number, column1: number) { |
| 320 | if (!fs.existsSync(fileName)) { |
| 321 | return |
| 322 | } |
| 323 | |
| 324 | // Sanitize lineNumber to prevent malicious use on win32 |
| 325 | // via: https://github.com/nodejs/node/blob/c3bb4b1aa5e907d489619fb43d233c3336bfc03d/lib/child_process.js#L333 |
| 326 | // and it should be a positive integer |
| 327 | if (!(Number.isInteger(line1) && line1 > 0)) { |
| 328 | return |
| 329 | } |
| 330 | |
| 331 | // colNumber is optional, but should be a positive integer too |
| 332 | // default is 1 |
| 333 | if (!(Number.isInteger(column1) && column1 > 0)) { |
| 334 | column1 = 1 |
| 335 | } |
| 336 | |
| 337 | let [editor, ...args] = guessEditor() |
| 338 | |
| 339 | if (!editor) { |
| 340 | printInstructions(fileName, null) |
| 341 | return |
| 342 | } |
| 343 | |
| 344 | if (editor.toLowerCase() === 'none') { |
| 345 | return |
| 346 | } |
| 347 | |
| 348 | if ( |
| 349 | process.platform === 'linux' && |
| 350 | fileName.startsWith('/mnt/') && |
| 351 | /Microsoft/i.test(os.release()) |
| 352 | ) { |
| 353 | // Assume WSL / "Bash on Ubuntu on Windows" is being used, and |
| 354 | // that the file exists on the Windows file system. |
| 355 | // `os.release()` is "4.4.0-43-Microsoft" in the current release |
| 356 | // build of WSL, see: https://github.com/Microsoft/BashOnWindows/issues/423#issuecomment-221627364 |
| 357 | // When a Windows editor is specified, interop functionality can |
| 358 | // handle the path translation, but only if a relative path is used. |
| 359 | fileName = path.relative('', fileName) |
| 360 | } |
| 361 | |
| 362 | // cmd.exe on Windows is vulnerable to RCE attacks given a file name of the |
| 363 | // form "C:\Users\myusername\Downloads\& curl 172.21.93.52". Use an access list |
| 364 | // to validate user-provided file names. This doesn't cover the entire range |
| 365 | // of valid file names but should cover almost all of them in practice. |
| 366 | if ( |
| 367 | process.platform === 'win32' && |
| 368 | !WINDOWS_FILE_NAME_ACCESS_LIST.test(fileName.trim()) |
| 369 | ) { |
| 370 | console.log() |
| 371 | console.log( |
| 372 | red('Could not open ' + path.basename(fileName) + ' in the editor.') |
| 373 | ) |
| 374 | console.log() |
| 375 | console.log( |
| 376 | 'When running on Windows, file names are checked against an access list ' + |
no test coverage detected