doc: clarify that any truthy value of `shell` is part of DEP0190 · nodejs/node@e5800cc · GitHub

nodejs / node Public

• Notifications You must be signed in to change notification settings
• Fork 36.6k
• Star 120k

• Code
• Issues 639
• Pull requests 564
• Actions
• Projects
• Security and quality
• Insights

Additional navigation options

Commit e5800cc

Browse filesBrowse the repository at this point in the historyBrowse files

aduh95

authored and

juanarbol

committed

doc: clarify that any truthy value of shell is part of DEP0190

PR-URL: #62249 Reviewed-By: René <contact.9a5d6388@renegade334.me.uk> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

1 parent eb776a3 commit e5800cc
Copy full SHA for e5800cc

1 file changed

+3-2Lines changed: 3 additions & 2 deletions

File tree

Expand file treeCollapse file tree

Open diff view settings

Filter options

• doc/api
  • deprecations.md

Expand file treeCollapse file tree

Open diff view settings

Collapse file

‎doc/api/deprecations.md‎

Copy file name to clipboardExpand all lines: doc/api/deprecations.md

+3-2Lines changed: 3 additions & 2 deletions

• Display the source diff
• Display the rich diff

Original file line number	Diff line number	Diff line change
@@ -3803,7 +3803,7 @@ Type: Documentation-only
3803	3803	`process.features.tls_alpn`, `process.features.tls_ocsp`, and `process.features.tls_sni` are
3804	3804	deprecated, as their values are guaranteed to be identical to that of `process.features.tls`.
3805	3805
3806		- ### DEP0190: Passing `args` to `node:child_process` `execFile`/`spawn` with `shell` option `true`
	3806	+ ### DEP0190: Passing `args` to `node:child_process` `execFile`/`spawn` with `shell` option
3807	3807
3808	3808	<!-- YAML
3809	3809	changes:
@@ -3816,7 +3816,8 @@ changes:
3816	3816	Type: Documentation-only
3817	3817
3818	3818	When an `args` array is passed to [`child_process.execFile`][] or [`child_process.spawn`][] with the option
3819		- `{ shell: true }`, the values are not escaped, only space-separated, which can lead to shell injection.
	3819	+ `{ shell: true }` or `{ shell: '/path/to/shell' }`, the values are not escaped, only space-separated,
	3820	+ which can lead to shell injection.
3820	3821
3821	3822	### DEP0191: `repl.builtinModules`
3822	3823

0 commit comments

Comments

0 (0)