fix(utils): resolve command injection vulnerability in emptyFolder (4.x) (#5191)

mhassan1 · kobenguyent · web-flow · commit bb737780f175 · 2025-10-29T14:37:44.000+01:00
* fix(utils): remove incorrect `async` from `emptyFolder`

* fix(utils): resolve command injection vulnerability in `emptyFolder`

---------

Co-authored-by: kobenguyent &lt;7845001+kobenguyent@users.noreply.github.com&gt;
diff --git a/lib/utils.js b/lib/utils.js
@@ -448,7 +448,11 @@ export const isNotSet = function (obj) {
 }
 
 export const emptyFolder = async directoryPath => {
-  childProcess.execSync(`rm -rf ${directoryPath}/*`)
+  // Do not throw on non-existent directory, since it may be created later
+  if (!fs.existsSync(directoryPath)) return
+  for (const file of fs.readdirSync(directoryPath)) {
+    fs.rmSync(path.join(directoryPath, file), { recursive: true, force: true })
+  }
 }
 
 export const printObjectProperties = obj => {

Original file line number	Diff line number	Diff line change
`@@ -448,7 +448,11 @@ export const isNotSet = function (obj) {`
`448`	`448`	`}`
`449`	`449`
`450`	`450`	`export const emptyFolder = async directoryPath => {`
`451`		- childProcess.execSync(`rm -rf ${directoryPath}/*`)
	`451`	`+ // Do not throw on non-existent directory, since it may be created later`
	`452`	`+ if (!fs.existsSync(directoryPath)) return`
	`453`	`+ for (const file of fs.readdirSync(directoryPath)) {`
	`454`	`+ fs.rmSync(path.join(directoryPath, file), { recursive: true, force: true })`
	`455`	`+ }`
`452`	`456`	`}`
`453`	`457`
`454`	`458`	`export const printObjectProperties = obj => {`