From e8ceafb07a6a29eeae4d4cb4a56c010c40625cc2 Mon Sep 17 00:00:00 2001
From: Justin Steven <justin@justinsteven.com>
Date: Fri, 2 Oct 2020 17:21:51 +1000
Subject: [PATCH] Fix a bypass for CVE-2020-16881

Fixes #107951

Uses child_process.execFile() rather than child_process.exec() to more
effectively resolve the command injection vulnerability.
---
 extensions/npm/src/features/packageJSONContribution.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/extensions/npm/src/features/packageJSONContribution.ts b/extensions/npm/src/features/packageJSONContribution.ts
index f154a875239..7103ce1fa1a 100644
--- a/extensions/npm/src/features/packageJSONContribution.ts
+++ b/extensions/npm/src/features/packageJSONContribution.ts
@@ -282,8 +282,8 @@ export class PackageJSONContribution implements IJSONContribution {
 
 	private npmView(pack: string): Promise<ViewPackageInfo | undefined> {
 		return new Promise((resolve, _reject) => {
-			const command = 'npm view --json ' + pack + ' description dist-tags.latest homepage version';
-			cp.exec(command, (error, stdout) => {
+			const args = ['view', '--json', pack, 'description', 'dist-tags.latest', 'homepage', 'version'];
+			cp.execFile('npm', args, (error, stdout) => {
 				if (!error) {
 					try {
 						const content = JSON.parse(stdout);