mirror of
https://github.com/angular/angular.git
synced 2026-09-14 13:54:52 +08:00
Matthew Beck
547d85addf
- Run comparison benchmark in an isolated git worktree to prevent workspace pollution and local branch conflicts. - Harden security by passing benchmark target and SHA as environment variables to prevent shell injection, and adding '--' to bazel query and git rev-parse. - Optimize workflow by removing pnpm caching to mitigate cache poisoning risks. - Improve robustness of benchmark log parsing, supporting both ZIP outputs and raw directories, and safely checking for JSON reports. - Centralize git command execution on the dev-infra GitClient for consistency. - Add tslib to benchpress dependencies to prevent module resolution failures.
57 lines
1.9 KiB
TypeScript
57 lines
1.9 KiB
TypeScript
/**
|
|
* @license
|
|
* Copyright Google LLC All Rights Reserved.
|
|
*
|
|
* Use of this source code is governed by an MIT-style license that can be
|
|
* found in the LICENSE file at https://angular.dev/license
|
|
*/
|
|
|
|
import {Log} from '@angular/ng-dev';
|
|
import childProcess from 'child_process';
|
|
import path from 'path';
|
|
import url from 'url';
|
|
|
|
const scriptDir = path.dirname(url.fileURLToPath(import.meta.url));
|
|
|
|
/** Absolute disk path to the project directory. */
|
|
export const projectDir: string = path.join(scriptDir, '../..');
|
|
|
|
/**
|
|
* Executes the given command with the provided arguments. Arguments are passed
|
|
* as a discrete array to the child process, bypassing shell interpretation.
|
|
* This ensures that special shell characters within arguments are treated as
|
|
* literal values and cannot be used to inject additional commands.
|
|
*/
|
|
export function exec(cmd: string, args: string[] = [], cwd: string = projectDir): Promise<string> {
|
|
return new Promise((resolve, reject) => {
|
|
Log.info('Running command:', cmd, args.join(' '), `(in ${cwd})`);
|
|
|
|
const proc = childProcess.spawn(cmd, args, {
|
|
// Do not use a shell to spawn the process. This ensures that arguments
|
|
// are passed directly to the executable without shell interpretation,
|
|
// preventing injection via shell metacharacters.
|
|
shell: false,
|
|
cwd,
|
|
// Only capture `stdout`. Forward the rest to the parent TTY.
|
|
stdio: ['inherit', 'pipe', 'inherit'],
|
|
});
|
|
let stdout = '';
|
|
|
|
proc.stdout.on('data', (chunk) => {
|
|
stdout += chunk.toString('utf8');
|
|
process.stdout.write(chunk);
|
|
});
|
|
|
|
proc.on('close', (status, signal) => {
|
|
if (status !== 0 || signal !== null) {
|
|
reject(`Command failed. Status code: ${status}. Signal: ${signal}`);
|
|
}
|
|
resolve(stdout);
|
|
});
|
|
|
|
proc.on('error', (err) => {
|
|
reject(`Command failed: ${err}`);
|
|
});
|
|
});
|
|
}
|