Commit 176d951
committed
doc: deprecate passing args to spawn and execFile
PR-URL: #57389
Refs: #57199
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Jason Zhang <xzha4350@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>1 parent 5c05ba1 commit 176d951
1 file changed
Lines changed: 17 additions & 0 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -3803,6 +3803,21 @@ Type: Documentation-only | |||
| 3803 | 3803 | `process.features.tls_alpn`, `process.features.tls_ocsp`, and `process.features.tls_sni` are | |
| 3804 | 3804 | deprecated, as their values are guaranteed to be identical to that of `process.features.tls`. | |
| 3805 | 3805 | ||
| 3806 | + ### DEP0190: Passing `args` to `node:child_process` `execFile`/`spawn` with `shell` option `true` | ||
| 3807 | + | ||
| 3808 | + <!-- YAML | ||
| 3809 | + changes: | ||
| 3810 | + - version: | ||
| 3811 | + - REPLACEME | ||
| 3812 | + pr-url: https://github.com/nodejs/node/pull/57389 | ||
| 3813 | + description: Documentation-only deprecation. | ||
| 3814 | + --> | ||
| 3815 | + | ||
| 3816 | + Type: Documentation-only | ||
| 3817 | + | ||
| 3818 | + When an `args` array is passed to [`child_process.execFile`][] or [`child_process.spawn`][] with the option | ||
| 3819 | + `{ shell: true }`, the values are not escaped, only space-separated, which can lead to shell injection. | ||
| 3820 | + | ||
| 3806 | 3821 | [NIST SP 800-38D]: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf | |
| 3807 | 3822 | [RFC 6066]: https://tools.ietf.org/html/rfc6066#section-3 | |
| 3808 | 3823 | [RFC 8247 Section 2.4]: https://www.rfc-editor.org/rfc/rfc8247#section-2.4 | |
@@ -3830,6 +3845,8 @@ deprecated, as their values are guaranteed to be identical to that of `process.f | |||
| 3830 | 3845 | [`assert`]: assert.md | |
| 3831 | 3846 | [`asyncResource.runInAsyncScope()`]: async_context.md#asyncresourceruninasyncscopefn-thisarg-args | |
| 3832 | 3847 | [`buffer.subarray`]: buffer.md#bufsubarraystart-end | |
| 3848 | + [`child_process.execFile`]: child_process.md#child_processexecfilefile-args-options-callback | ||
| 3849 | + [`child_process.spawn`]: child_process.md#child_processspawncommand-args-options | ||
| 3833 | 3850 | [`child_process`]: child_process.md | |
| 3834 | 3851 | [`clearInterval()`]: timers.md#clearintervaltimeout | |
| 3835 | 3852 | [`clearTimeout()`]: timers.md#cleartimeouttimeout | |
0 commit comments