check android emulator names

Summary: maliciously named Android emulators could execute arbitrary commands. This checks makes sure the emulator name only has valid characters and puts them in quotes to prevent executing other commands.

Reviewed By: jknoxville

Differential Revision: D8489024

fbshipit-source-id: d91011ceaa8abf0ac53a308089cbdd0b0db03b54

src/chrome/DevicesButton.js

@@ -189,10 +189,16 @@ class DevicesButton extends Component<Props, State> {
   }
 
   launchEmulator = (name: string) => {
-    child_process.exec(
-      `$ANDROID_HOME/tools/emulator @${name}`,
-      this.updateEmulatorState,
-    );
+    if (/^[a-zA-Z0-9-_\s]+$/.test(name)) {
+      child_process.exec(
+        `$ANDROID_HOME/tools/emulator -avd "${name}"`,
+        this.updateEmulatorState,
+      );
+    } else {
+      console.error(
+        `Can not launch emulator named ${name}, because it's name contains invalid characters.`,
+      );
+    }
   };
 
   createEmualtor = () => {};