Unsafe shell command constructed from library input in AutomationEnvironment.ts

[jonthysell]

Problem Description

CodeQL caught that we're using shell commands from JS to get info about an appx and then launch it for unit tests.

packages/@react-native-windows/automation/src/AutomationEnvironment.ts : 202

packages/@react-native-windows/automation/src/AutomationEnvironment.ts : 327

Steps To Reproduce

See CodeQL alert.

Expected Results

No response

CLI version

npx @react-native-community/cli -v

Environment

npx @react-native-community/cli info

Community Modules

No response

Target Platform Version

None

Target Device(s)

No response

Visual Studio Version

None

Build Configuration

None

Snack, code example, screenshot, or link to a repository

No response

[jonthysell]

This alert has disappeared in CodeQL. Closing.

[jonthysell]

And now it's back...