From 39134b78b212a5f10344545324ed90d8a149edb8 Mon Sep 17 00:00:00 2001
From: anupamme <mediratta@gmail.com>
Date: Mon, 24 Aug 2026 03:34:15 +0000
Subject: [PATCH] harden: sanitize child_process call in main.js

Detected calls to child_process from a function argument `dartPath`
Addresses javascript.lang.security.detect-child-process.detect-child-process
---
 lib/main.js | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/lib/main.js b/lib/main.js
index f0f0e41..29283e5 100644
--- a/lib/main.js
+++ b/lib/main.js
@@ -1,4 +1,4 @@
-import { execSync } from 'child_process'
+import { execSync, execFileSync } from 'child_process'
 import fs from 'fs'
 import path from 'path'
 import yaml from 'js-yaml'
@@ -55,7 +55,7 @@ function recFindByExt(base, ext, files, result) {
 
     files.forEach(
         function (file) {
-            var newbase = path.join(base, file)
+            var newbase = path.join(base, path.basename(file))
             if (fs.statSync(newbase).isDirectory()) {
                 result = recFindByExt(newbase, ext, fs.readdirSync(newbase), result)
             } else {
@@ -83,7 +83,7 @@ function writeOutputToFileByPath(result, srcPath) {
 
     let dartFile = components.join('.').toLowerCase()
 
-    var outputFile = outputDir ? path.join(outputDir, dartFile) : dartFile
+    var outputFile = outputDir ? path.join(outputDir, path.basename(dartFile)) : dartFile
     fs.writeFileSync(outputFile, result)
     return outputFile
 }
@@ -125,8 +125,7 @@ function postprocessingFiles(filePaths) {
 }
 
 function formatDartFile(dartPath) {
-    var command = 'flutter format ' + dartPath
-    execSync(command, { stdio: 'inherit' })
+    execFileSync('flutter', ['format', dartPath], { stdio: 'inherit' })
 }
 
 function createFlutterPackage(template, projectName) {
@@ -262,7 +261,7 @@ export async function main(input, options, onMainThread = false) {
     projectName = options.projectName
     let template = options.template
     if (projectName && checkTemplateValid(template)) {
-        outputDir = path.join(outputDir, projectName)
+        outputDir = path.join(outputDir, path.basename(projectName))
         createFlutterPackage(template, projectName)
         outputDir = path.join(outputDir, 'lib')
     }