From bbbe0fe1c752dbfa78b01c7f988d44c57d0ae8ab Mon Sep 17 00:00:00 2001
From: anupamme <mediratta@gmail.com>
Date: Sun, 9 Aug 2026 22:50:13 +0000
Subject: [PATCH 1/2] fix:
 javascript.lang.security.detect-child-process.detect-child-process security
 vulnerability

Automated security fix generated by OrbisAI Security
---
 index.js | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/index.js b/index.js
index b408649..95135a5 100644
--- a/index.js
+++ b/index.js
@@ -1,11 +1,13 @@
 const path = require('path')
-const { execSync } = require('child_process')
+const { execFileSync } = require('child_process')
 const settings = {}
 settings.disableRegisterGlobalModel = false
 
 function run (script) {
+  const safeScript = path.basename(script)
+  const scriptPath = `${__dirname}${path.sep}${safeScript}`
   try {
-    const stdout = execSync(`php ${path.join(__dirname, script)}`)
+    const stdout = execFileSync('php', [scriptPath])
     return stdout.toString()
   } catch (err) {
     throw new Error(`PHP process exited with code ${err.status}`)
@@ -27,7 +29,7 @@ function runWithData (template, model) {
   const jsonModel = JSON.stringify(model, circular())
 
   try {
-    const stdout = execSync(`php ${path.join(__dirname, '/loader.php')}`, {
+    const stdout = execFileSync('php', [path.join(__dirname, '/loader.php')], {
       input: jsonModel
     })
     return stdout.toString()

From 32639dde9274a363d3d7ccadbcca30a88174cedc Mon Sep 17 00:00:00 2001
From: Anupam Mediratta <mediratta@gmail.com>
Date: Mon, 10 Aug 2026 06:58:16 +0530
Subject: [PATCH 2/2] fix: remove path.basename regression, add shell
 metacharacter test

Remove path.basename() from run() which was stripping directory components
and breaking subdirectory script paths. Replace with path.join(__dirname, script)
to preserve the original path resolution while keeping the execFileSync fix.

Add a test asserting that shell metacharacters in the script path are treated
as a literal filename by execFileSync rather than interpreted by a shell.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 index.js     | 3 +--
 test/test.js | 8 ++++++++
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/index.js b/index.js
index 95135a5..01fad4f 100644
--- a/index.js
+++ b/index.js
@@ -4,8 +4,7 @@ const settings = {}
 settings.disableRegisterGlobalModel = false
 
 function run (script) {
-  const safeScript = path.basename(script)
-  const scriptPath = `${__dirname}${path.sep}${safeScript}`
+  const scriptPath = path.join(__dirname, script)
   try {
     const stdout = execFileSync('php', [scriptPath])
     return stdout.toString()
diff --git a/test/test.js b/test/test.js
index dd25008..d5daf6b 100644
--- a/test/test.js
+++ b/test/test.js
@@ -34,6 +34,14 @@ test.serial('Executing a PHP script that has a coding error with `run`', async t
   }
 })
 
+test.serial('Shell metacharacters in the script path are not executed as shell commands', async t => {
+  try {
+    await php.run('./test/lib/templates/selfContainedTest.php; echo pwned')
+  } catch (e) {
+    t.true(e.message.includes('PHP process exited with code'))
+  }
+})
+
 test.serial('Executing a PHP script that has a coding error with `runWithData`', async t => {
   try {
     await php.runWithData('./test/lib/templates/codingError.php')