Merge pull request #5887 from NomicFoundation/more-init-fixes

Prevent a shell injection in `--init`
NomicFoundation · Oct 29, 2024 · 2c8ca38 · 2c8ca38
2 parents 0e36a8c + f5e58e5
commit 2c8ca38
Show file tree

Hide file tree

Showing 3 changed files with 4 additions and 3 deletions.
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
diff --git a/v-next/hardhat/src/internal/cli/init/init.ts b/v-next/hardhat/src/internal/cli/init/init.ts
@@ -378,7 +378,8 @@ export async function installProjectDependencies(
 
       await spawn(command[0], command.slice(1), {
         cwd: workspace,
-        shell: true,
+        // We don't want the arguments to be treated as shell expressions
+        shell: false,
         stdio: "inherit",
       });
 

diff --git a/v-next/hardhat/templates/mocha-ethers/package.json b/v-next/hardhat/templates/mocha-ethers/package.json
@@ -11,7 +11,7 @@
     "@ignored/hardhat-vnext-network-helpers": "workspace:^3.0.0-next.3",
     "@types/chai": "^4.2.0",
     "@types/chai-as-promised": "^8.0.1",
-    "@types/mocha": ">=9.1.0",
+    "@types/mocha": "^10.0.0",
     "chai": "^4.4.1",
     "chai-as-promised": "^8.0.0",
     "forge-std": "foundry-rs/forge-std#v1.9.4",