refactor(dev-infra): use shell: false and quote args in benchmark-compare workflow

herdiyana256 · amishne · commit f219e658416f · 2026-04-28T10:29:24.000-07:00
Currently, the exec() utility uses childProcess.spawn() with shell: true. This commit changes the spawn option to shell: false to prevent OS command injection vulnerabilities and quotes the benchmark target in the github action.
diff --git a/.github/workflows/benchmark-compare.yml b/.github/workflows/benchmark-compare.yml
@@ -49,7 +49,8 @@ jobs:
           COMMENT_BODY: ${{ github.event.comment.body }}
         run: pnpm benchmarks prepare-for-github-action "$COMMENT_BODY"
 
-      - run: pnpm benchmarks run-compare ${{steps.info.outputs.compareSha}} ${{steps.info.outputs.benchmarkTarget}}
+      - run: pnpm benchmarks run-compare ${{steps.info.outputs.compareSha}} "${{steps.info.outputs.benchmarkTarget}}"
+
         id: benchmark
         name: Running benchmark
 
diff --git a/scripts/benchmarks/utils.mts b/scripts/benchmarks/utils.mts
@@ -17,15 +17,20 @@ const scriptDir = path.dirname(url.fileURLToPath(import.meta.url));
 export const projectDir: string = path.join(scriptDir, '../..');
 
 /**
- * Executes the given command, forwarding stdin, stdout and stderr while
- * still capturing stdout in order to return it.
+ * Executes the given command with the provided arguments. Arguments are passed
+ * as a discrete array to the child process, bypassing shell interpretation.
+ * This ensures that special shell characters within arguments are treated as
+ * literal values and cannot be used to inject additional commands.
  */
 export function exec(cmd: string, args: string[] = []): Promise<string> {
   return new Promise((resolve, reject) => {
     Log.info('Running command:', cmd, args.join(' '));
 
     const proc = childProcess.spawn(cmd, args, {
-      shell: true,
+      // Do not use a shell to spawn the process. This ensures that arguments
+      // are passed directly to the executable without shell interpretation,
+      // preventing injection via shell metacharacters.
+      shell: false,
       cwd: projectDir,
       // Only capture `stdout`. Forward the rest to the parent TTY.
       stdio: ['inherit', 'pipe', 'inherit'],
