fix: fix command injection vector

feross · Apr 6, 2022 · f9ce092 · f9ce092
1 parent 4f8b9ba
commit f9ce092
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/index.js b/index.js
@@ -28,7 +28,7 @@ function gitPullOrClone (url, outPath, opts, cb) {
   function gitClone () {
     // --depth implies --single-branch
     const flag = depth < Infinity ? '--depth=' + depth : '--single-branch'
-    const args = ['clone', flag, url, outPath]
+    const args = ['clone', flag, '--', url, outPath]
     debug('git ' + args.join(' '))
     spawn('git', args, {}, function (err) {
       if (err) err.message += ' (git clone) (' + url + ')'