fix: CVE-2024-21538 by migrating to promisify-child-process

detox/local-cli/utils/frameworkUtils.js

@@ -1,13 +1,12 @@
 const os = require('os');
 const path = require('path');
 
-const { spawn } = require('child-process-promise');
 const fs = require('fs-extra');
+const { spawn } = require('promisify-child-process');
 
 const detox = require('../../internals');
 const { getFrameworkDirPath, getXCUITestRunnerDirPath } = require('../../src/utils/environment');
 
-
 const frameworkBuildScript = '../../scripts/build_local_framework.ios.sh';
 const xcuitestBuildScript = '../../scripts/build_local_xcuitest.ios.sh';
 

detox/package.json

@@ -64,7 +64,7 @@
     "prettier": "^3.1.1",
     "react-native": "0.76.3",
     "react-native-codegen": "^0.0.8",
-    "typescript": "^5.3.3",
+    "typescript": "~5.3.3",
     "wtfnode": "^0.9.1"
   },
   "dependencies": {
@@ -73,14 +73,14 @@
     "bunyan-debug-stream": "^3.1.0",
     "caf": "^15.0.1",
     "chalk": "^4.0.0",
-    "child-process-promise": "^2.2.0",
-    "detox-copilot": "^0.0.27",
+    "detox-copilot": "^0.0.24",
     "execa": "^5.1.1",
     "find-up": "^5.0.0",
     "fs-extra": "^11.0.0",
     "funpermaproxy": "^1.1.0",
     "glob": "^8.0.3",
     "ini": "^1.3.4",
+    "promisify-child-process": "^4.1.2",
     "jest-environment-emit": "^1.0.8",
     "json-cycle": "^1.3.0",
     "lodash": "^4.17.11",

detox/src/devices/common/drivers/android/exec/ADB.js

@@ -366,6 +366,7 @@ class ADB {
     const _spawnOptions = {
       ...spawnOptions,
       capture: ['stdout'],
+      encoding: 'utf8',
     };
     return spawnWithRetriesAndLogs(this.adbBin, _flags, _spawnOptions);
   }

detox/src/devices/common/drivers/android/exec/ADB.test.js

@@ -133,6 +133,7 @@ describe('ADB', () => {
       retries: 3,
       timeout: 45000,
       capture: ['stdout'],
+      encoding: 'utf8',
     };
     await adb.install(deviceId, 'path/to/bin.apk');
 
@@ -213,6 +214,7 @@ describe('ADB', () => {
       retries: 3,
       timeout: 45000,
       capture: ['stdout'],
+      encoding: 'utf8',
     };
     const binaryPath = '/mock-path/filename.mock';
     await adb.install(deviceId, binaryPath);

detox/src/devices/common/drivers/android/exec/BinaryExec.js

@@ -1,5 +1,4 @@
-// @ts-nocheck
-const spawn = require('child-process-promise').spawn;
+const { spawn } = require('promisify-child-process');
 
 const exec = require('../../../../../utils/childProcess').execWithRetriesAndLogs;
 
@@ -27,15 +26,17 @@ class BinaryExec {
   }
 
   async exec(command) {
-    return (await exec(`"${this.binary}" ${command._getArgsString()}`)).stdout;
+    const result = await exec(`"${this.binary}" ${command._getArgsString()}`);
+
+    return result.stdout;
   }
 
   spawn(command, stdout, stderr) {
-    return spawn(this.binary, command._getArgs(), { detached: true, stdio: ['ignore', stdout, stderr] });
+    return spawn(this.binary, command._getArgs(), { detached: true, encoding: 'utf8', stdio: ['ignore', stdout, stderr] });
   }
 }
 
 module.exports = {
   ExecCommand,
-  BinaryExec,
+  BinaryExec
 };

detox/src/devices/common/drivers/android/exec/BinaryExec.test.js

@@ -1,3 +1,4 @@
+/* eslint-disable node/no-extraneous-require */
 describe('BinaryExec', () => {
   const binaryPath = '/binary/mock';
 
@@ -12,10 +13,10 @@ describe('BinaryExec', () => {
     }));
     exec = require('../../../../../utils/childProcess').execWithRetriesAndLogs;
 
-    jest.mock('child-process-promise', () => ({
+    jest.mock('promisify-child-process', () => ({
       spawn: jest.fn()
     }));
-    spawn = require('child-process-promise').spawn;
+    spawn = require('promisify-child-process').spawn;
 
     const { BinaryExec } = require('./BinaryExec');
     binaryExec = new BinaryExec(binaryPath);
@@ -87,7 +88,7 @@ describe('BinaryExec', () => {
       expect(spawn).toHaveBeenCalledWith(binaryPath, commandArgs, expect.anything());
     });
 
-    it('should chain-return child-process-promise from spawn', async () => {
+    it('should chain-return promisify-child-process from spawn', async () => {
       const childProcessPromise = Promise.resolve('mock result');
       spawn.mockReturnValue(childProcessPromise);
 

detox/src/devices/runtime/drivers/ios/SimulatorDriver.js

@@ -1,8 +1,8 @@
 // @ts-nocheck
 const path = require('path');
 
-const exec = require('child-process-promise').exec;
 const _ = require('lodash');
+const { exec } = require('promisify-child-process');
 
 const temporaryPath = require('../../../../artifacts/utils/temporaryPath');
 const DetoxRuntimeError = require('../../../../errors/DetoxRuntimeError');
@@ -16,7 +16,6 @@ const traceInvocationCall = require('../../../../utils/traceInvocationCall').bin
 
 const IosDriver = require('./IosDriver');
 
-
 /**
  * @typedef SimulatorDriverDeps { DeviceDriverDeps }
  * @property applesimutils { AppleSimUtils }
@@ -111,8 +110,9 @@ class SimulatorDriver extends IosDriver {
     if (Number.isNaN(pid)) {
       throw new DetoxRuntimeError({
         message: `Failed to find a process corresponding to the app bundle identifier (${bundleId}).`,
-        hint: `Make sure that the app is running on the device (${udid}), visually or via CLI:\n` +
-              `xcrun simctl spawn ${this.udid} launchctl list | grep -F '${bundleId}'\n`,
+        hint:
+          `Make sure that the app is running on the device (${udid}), visually or via CLI:\n` +
+          `xcrun simctl spawn ${this.udid} launchctl list | grep -F '${bundleId}'\n`
       });
     } else {
       log.info({}, `Found the app (${bundleId}) with process ID = ${pid}. Proceeding...`);
@@ -141,7 +141,7 @@ class SimulatorDriver extends IosDriver {
     const xcuitestRunner = new XCUITestRunner({ runtimeDevice: { id: this.getExternalId(), _bundleId } });
     let x = point?.x ?? 100;
     let y = point?.y ?? 100;
-    let _pressDuration = pressDuration ? (pressDuration / 1000) : 1;
+    let _pressDuration = pressDuration ? pressDuration / 1000 : 1;
     const traceDescription = actionDescription.longPress({ x, y }, _pressDuration);
     return this.withAction(xcuitestRunner, 'coordinateLongPress', traceDescription, x.toString(), y.toString(), _pressDuration.toString());
   }
@@ -210,7 +210,7 @@ class SimulatorDriver extends IosDriver {
     await this.emitter.emit('createExternalArtifact', {
       pluginId: 'screenshot',
       artifactName: screenshotName || path.basename(tempPath, '.png'),
-      artifactPath: tempPath,
+      artifactPath: tempPath
     });
 
     return tempPath;
@@ -223,7 +223,7 @@ class SimulatorDriver extends IosDriver {
     await this.emitter.emit('createExternalArtifact', {
       pluginId: 'uiHierarchy',
       artifactName: artifactName,
-      artifactPath: viewHierarchyURL,
+      artifactPath: viewHierarchyURL
     });
 
     return viewHierarchyURL;

detox/src/ios/XCUITestRunner.js

@@ -1,4 +1,4 @@
-const { exec } = require('child-process-promise');
+const { exec } = require('promisify-child-process');
 
 const DetoxRuntimeError = require('../errors/DetoxRuntimeError');
 const environment = require('../utils/environment');

detox/src/ios/XCUITestRunner.test.js

@@ -1,12 +1,12 @@
 const XCUITestRunner = require('./XCUITestRunner');
 
-jest.mock('child-process-promise', () => {
+jest.mock('promisify-child-process', () => {
     return {
         exec: jest.fn(),
     };
 });
 
-const { exec } = jest.requireMock('child-process-promise');
+const { exec } = jest.requireMock('promisify-child-process');
 const environment = jest.requireMock('../utils/environment');
 
 jest.mock('../utils/environment');

detox/src/utils/childProcess/exec.js

@@ -1,13 +1,19 @@
 // @ts-nocheck
-const { exec } = require('child-process-promise');
 const _ = require('lodash');
+const { exec } = require('promisify-child-process');
 
 const DetoxRuntimeError = require('../../errors/DetoxRuntimeError');
 const rootLogger = require('../logger').child({ cat: ['child-process', 'child-process-exec'] });
 const retry = require('../retry');
 
 const execsCounter = require('./opsCounter');
 
+/**
+ * Executes a command with retries and logs
+ * @param {*} bin - command to execute
+ * @param {*} options - options
+ * @returns {Promise<import('promisify-child-process').Output>}
+ */
 async function execWithRetriesAndLogs(bin, options = {}) {
   const {
     retries = 9,

detox/src/utils/childProcess/exec.test.js

@@ -7,8 +7,8 @@ describe('Exec utils', () => {
     jest.mock('../logger');
     logger = require('../logger');
 
-    jest.mock('child-process-promise');
-    cpp = require('child-process-promise');
+    jest.mock('promisify-child-process');
+    cpp = require('promisify-child-process');
 
     exec = require('./exec');
   });
@@ -91,8 +91,8 @@ describe('Exec utils', () => {
       args: `--argument 123`,
       statusLogs: {
         trying: 'trying status log',
-        successful: 'successful status log',
-      },
+        successful: 'successful status log'
+      }
     };
     await execWithRetriesAndLogs('bin', options);
 
@@ -110,8 +110,8 @@ describe('Exec utils', () => {
     const options = {
       args: `--argument 123`,
       statusLogs: {
-        retrying: true,
-      },
+        retrying: true
+      }
     };
 
     logger.debug.mockClear();
@@ -233,20 +233,20 @@ describe('Exec utils', () => {
 });
 
 const returnSuccessfulWithValue = (value) => ({
-    stdout: JSON.stringify(value),
-    stderr: 'err',
-    childProcess: {
-      exitCode: 0
-    }
-  });
+  stdout: JSON.stringify(value),
+  stderr: 'err',
+  childProcess: {
+    exitCode: 0
+  }
+});
 
 const returnErrorWithValue = (value) => ({
-    stdout: 'out',
-    stderr: value,
-    childProcess: {
-      exitCode: 1
-    }
-  });
+  stdout: 'out',
+  stderr: value,
+  childProcess: {
+    exitCode: 1
+  }
+});
 
 function mockCppSuccessful(cpp) {
   const successfulResult = returnSuccessfulWithValue('successful result');

detox/src/utils/childProcess/spawn.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
-const { spawn } = require('child-process-promise');
 const _ = require('lodash');
+const { spawn } = require('promisify-child-process');
 
 const rootLogger = require('../logger').child({ cat: ['child-process', 'child-process-spawn'] });
 const { escape } = require('../pipeCommands');
@@ -32,7 +32,8 @@ async function spawnWithRetriesAndLogs(binary, flags, options = {}) {
   let result;
   await retry({ retries, interval }, async (tryCount, lastError) => {
     _logSpawnRetrying(logger, tryCount, lastError);
-    result = await _spawnAndLog(logger, binary, flags, command, spawnOptions, tryCount);
+    result = _spawnAndLog(logger, binary, flags, command, spawnOptions, tryCount);
+    await result;
   });
   return result;
 }
@@ -69,8 +70,20 @@ async function interruptProcess(childProcessPromise, schedule) {
 function _spawnAndLog(logger, binary, flags, command, options, tryCount) {
   const { logLevelPatterns, silent, ...spawnOptions } = { stdio: ['ignore', 'pipe', 'pipe'], ...options };
   const cpPromise = spawn(binary, flags, spawnOptions);
+  const childProcess = cpPromise.childProcess = cpPromise;
+  const originalThen = cpPromise.then.bind(cpPromise);
+  const augmentPromise = (fn) => {
+    return typeof fn === 'function'
+      ? (result) => fn(Object.assign(result, {
+        childProcess,
+        exitCode: childProcess.exitCode,
+        pid: childProcess.pid
+      }))
+      : fn;
+  };
+  cpPromise.then = (onFulfilled, onRejected) => originalThen(augmentPromise(onFulfilled), augmentPromise(onRejected));
+  cpPromise.catch = (onRejected) => cpPromise.then(undefined, onRejected);
 
-  const { childProcess } = cpPromise;
   const { exitCode, stdout, stderr } = childProcess;
 
   const _logger = logger.child({ cpid: childProcess.pid });
@@ -85,8 +98,12 @@ function _spawnAndLog(logger, binary, flags, command, options, tryCount) {
     stderr && stderr.on('data', _spawnStderrLoggerFn(_logger, logLevelPatterns));
   }
 
+  /**
+   *
+   * @param {import('promisify-child-process').Output} resultOrErr
+   */
   function onEnd(resultOrErr) {
-    const signal = resultOrErr.childProcess.signalCode || '';
+    const signal = resultOrErr.signal || '';
     const { code } = resultOrErr;
     const action = signal ? `terminated with ${signal}` : `exited with code #${code}`;