You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Adding the package react-native-clean-project to the dependencies makes the config command never exit #567
That's odd. I can reproduce this. Seems like commander refuses to exit cleanly, likely because of some leak (possibly in the mentioned library). In the meantime, here's a workaround (to apply e.g. with patch-package):
I guess a simple json file for defining these commands would better than running a js file of untrusted code. But I guess thats no simple migration. In the meanwhile process.exit() should mitigate the worst
guess a simple json file for defining these commands would better than running a js file of untrusted code
That's a valid concern, and this example shows that the current mechanism can be exploited. Having JS-based config makes it hard to avid. We could require users to explicitly define commands and get rid of auto-discovery, but not sure what's the best path forward here.
Activity
thymikee commentedon Jul 19, 2019
That's odd. I can reproduce this. Seems like commander refuses to exit cleanly, likely because of some leak (possibly in the mentioned library). In the meantime, here's a workaround (to apply e.g. with patch-package):
Pita commentedon Jul 19, 2019
@thymikee Thanks for the quick response!
Managed to fix it in the library: https://github.com/pmadruga/react-native-clean-project/pull/23/files
I guess a simple json file for defining these commands would better than running a js file of untrusted code. But I guess thats no simple migration. In the meanwhile
process.exit()should mitigate the worstthymikee commentedon Jul 19, 2019
Glad you fixed the issue so quickly :)
That's a valid concern, and this example shows that the current mechanism can be exploited. Having JS-based config makes it hard to avid. We could require users to explicitly define commands and get rid of auto-discovery, but not sure what's the best path forward here.