npmpackage.info

Gathering detailed insights and metrics for shell-quote

Other packages similar to shell-quote

@types/shell-quote

1.7.5

TypeScript definitions for shell-quote

shell-quote-word

1.0.1

unquote a single shell arguments

shell-split

1.0.0

A lighterweight alternative to shell-quote

@ckeditor/ckeditor5-block-quote

43.3.1

Block quote feature for CKEditor 5.

Gathering detailed insights and metrics for shell-quote

shell-quote

1.8.2

MIT

JavaScript

1.25 kB

3,587,946,080 4.6

Installations

npm install shell-quote

Pull Requests

Open

0

Total

4

Closed

1

Merged

3

Issues

Open

8

Total

14

Closed

6

Releases

Unable to fetch releases

Developer

ljharb

Developer Guide

BETA

Module System

CommonJS

Min. Node Version

>= 0.4

Typescript Support

No

Node Version

23.3.0

NPM Version

10.9.0 Statistics

28 Stars

204 Commits

10 Forks

4 Watching

2 Branches

17 Contributors

Updated on 27 Nov 2024

Bundle Size

2.53 kB

Minified

1.25 kB

Minified + Gzipped

Bundlephobia

Languages

JavaScript (100%)

Total Downloads

Cumulative downloads

Total Downloads

3,587,946,080

Last day

-7.6%

4,113,202

Compared to previous day

Last week

2.5%

24,030,487

Compared to previous week

Last month

11.1%

98,880,756

Compared to previous month

Last year

23.9%

983,406,155

Compared to previous year

Daily Downloads

Weekly Downloads

Monthly Downloads

Yearly Downloads

Dev Dependencies

@ljharb/eslint-config auto-changelog encoding eslint evalmd in-publish jackspeak npmignore nyc safe-publish-latest tape

Versions

shell-quote

Parse and quote shell commands.

example

quote

1var quote = require('shell-quote/quote');
2var s = quote([ 'a', 'b c d', '$f', '"g"' ]);
3console.log(s);

output

a 'b c d' \$f '"g"'

parse

1var parse = require('shell-quote/parse');
2var xs = parse('a "b c" \\$def \'it\\\'s great\'');
3console.dir(xs);

output

[ 'a', 'b c', '\\$def', 'it\'s great' ]

parse with an environment variable

1var parse = require('shell-quote/parse');
2var xs = parse('beep --boop="$PWD"', { PWD: '/home/robot' });
3console.dir(xs);

output

[ 'beep', '--boop=/home/robot' ]

parse with custom escape character

1var parse = require('shell-quote/parse');
2var xs = parse('beep ^--boop="$PWD"', { PWD: '/home/robot' }, { escape: '^' });
3console.dir(xs);

output

[ 'beep --boop=/home/robot' ]

parsing shell operators

1var parse = require('shell-quote/parse');
2var xs = parse('beep || boop > /byte');
3console.dir(xs);

output:

[ 'beep', { op: '||' }, 'boop', { op: '>' }, '/byte' ]

parsing shell comment

1var parse = require('shell-quote/parse');
2var xs = parse('beep > boop # > kaboom');
3console.dir(xs);

output:

[ 'beep', { op: '>' }, 'boop', { comment: '> kaboom' } ]

methods

1var quote = require('shell-quote/quote');
2var parse = require('shell-quote/parse');

quote(args)

Return a quoted string for the array args suitable for using in shell commands.

parse(cmd, env={})

Return an array of arguments from the quoted string cmd.

Interpolate embedded bash-style $VARNAME and ${VARNAME} variables with the env object which like bash will replace undefined variables with "".

env is usually an object but it can also be a function to perform lookups. When env(key) returns a string, its result will be output just like env[key] would. When env(key) returns an object, it will be inserted into the result array like the operator objects.

When a bash operator is encountered, the element in the array with be an object with an "op" key set to the operator string. For example:

'beep || boop > /byte'

parses as:

[ 'beep', { op: '||' }, 'boop', { op: '>' }, '/byte' ]

install

With npm do:

npm install shell-quote

license

MIT

Stable Version

The latest stable version of the package.

Stable Version

1.8.2

CRITICAL

9.8/10

Summary

Improper Neutralization of Special Elements used in a Command in Shell-quote

Affected Versions

<= 1.7.2

Patched Versions

1.7.3

CRITICAL

9.8/10

Summary

Potential Command Injection in shell-quote

Affected Versions

< 1.6.1

Patched Versions

1.6.1

10

Security-Policy

Determines if the project has published a security policy.

10

Dangerous-Workflow

Determines if the project's GitHub Action workflows avoid dangerous patterns.

10

Binary-Artifacts

Determines if the project has generated executable (binary) artifacts in the source repository.

10

License

Determines if the project has defined a license.

10

Vulnerabilities

Determines if the project has open, known unfixed vulnerabilities.

1

Code-Review

Determines if the project requires human code review before pull requests (aka merge requests) are merged.

0

Maintained

Determines if the project is "actively maintained".

0

Pinned-Dependencies

Determines if the project has declared and pinned the dependencies of its build process.

Reason

dependency not pinned by hash detected -- score normalized to 0

Details

Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs.yml:40: update your workflow using https://app.stepsecurity.io/secureworkflow/ljharb/shell-quote/nodejs.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/nodejs.yml:46: update your workflow using https://app.stepsecurity.io/secureworkflow/ljharb/shell-quote/nodejs.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs.yml:54: update your workflow using https://app.stepsecurity.io/secureworkflow/ljharb/shell-quote/nodejs.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/nodejs.yml:72: update your workflow using https://app.stepsecurity.io/secureworkflow/ljharb/shell-quote/nodejs.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs.yml:91: update your workflow using https://app.stepsecurity.io/secureworkflow/ljharb/shell-quote/nodejs.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/nodejs.yml:93: update your workflow using https://app.stepsecurity.io/secureworkflow/ljharb/shell-quote/nodejs.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs.yml:101: update your workflow using https://app.stepsecurity.io/secureworkflow/ljharb/shell-quote/nodejs.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/nodejs.yml:112: update your workflow using https://app.stepsecurity.io/secureworkflow/ljharb/shell-quote/nodejs.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/nodejs.yml:12: update your workflow using https://app.stepsecurity.io/secureworkflow/ljharb/shell-quote/nodejs.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/rebase.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/ljharb/shell-quote/rebase.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/rebase.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/ljharb/shell-quote/rebase.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/require-allow-edits.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/ljharb/shell-quote/require-allow-edits.yml/main?enable=pin
Info: 0 out of 5 GitHub-owned GitHubAction dependencies pinned
Info: 0 out of 7 third-party GitHubAction dependencies pinned

0

Token-Permissions

Determines if the project's workflows follow the principle of least privilege.

0

CII-Best-Practices

Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.

0

Fuzzing

Determines if the project uses fuzzing.

0

SAST

Determines if the project uses static code analysis.

Score

4.6

/10

Last Scanned on 2024-11-18

The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.

Learn More