Discussion on: Executing Shell Scripts with NodeJS

[Aabhas Sao]

Thanks @antongolub I didn't knew. The libraries you mentioned seem cool. I would check them out. Why is using child process like this unsafe didn't understood well. Any article ont that?

[Anton Golub]

Ok, here's a RCE example)

const arg = '"hello" && echo "rm -rf ./ may be here"'
const cmd = `echo ${arg}`

Key tip: you need to understand the boundaries of the arguments and escape the characters that can violate them.

[Aabhas Sao]

Thanks now I get it. Passing user input in such commands can be dangerous. Similar to the way SQL injection attacks happen by I'll formatted arguments.

[Aabhas Sao]

I would surely put some disclaimer on that.