doc: clarify that any truthy value of `shell` is part of DEP0190 · nodejs/node@f976c92 · GitHub

nodejs / node Public

• Notifications You must be signed in to change notification settings
• Fork 36.6k
• Star 120k

• Code
• Issues 633
• Pull requests 749
• Actions
• Projects
• Security and quality
• Insights

Additional navigation options

Commit f976c92

Browse filesBrowse the repository at this point in the historyBrowse files

aduh95

committed

doc: clarify that any truthy value of shell is part of DEP0190

PR-URL: #62249 Reviewed-By: René <contact.9a5d6388@renegade334.me.uk> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

1 parent 531c64d commit f976c92
Copy full SHA for f976c92

1 file changed

+3-2Lines changed: 3 additions & 2 deletions

File tree

Expand file treeCollapse file tree

Open diff view settings

Filter options

• doc/api
  • deprecations.md

Expand file treeCollapse file tree

Open diff view settings

Collapse file

‎doc/api/deprecations.md‎

Copy file name to clipboardExpand all lines: doc/api/deprecations.md

+3-2Lines changed: 3 additions & 2 deletions

• Display the source diff
• Display the rich diff

Original file line number	Diff line number	Diff line change
@@ -4164,7 +4164,7 @@ Type: Documentation-only
4164	4164	`process.features.tls_alpn`, `process.features.tls_ocsp`, and `process.features.tls_sni` are
4165	4165	deprecated, as their values are guaranteed to be identical to that of `process.features.tls`.
4166	4166
4167		- ### DEP0190: Passing `args` to `node:child_process` `execFile`/`spawn` with `shell` option `true`
	4167	+ ### DEP0190: Passing `args` to `node:child_process` `execFile`/`spawn` with `shell` option
4168	4168
4169	4169	<!-- YAML
4170	4170	changes:
@@ -4181,7 +4181,8 @@ changes:
4181	4181	Type: Runtime
4182	4182
4183	4183	When an `args` array is passed to [`child_process.execFile`][] or [`child_process.spawn`][] with the option
4184		- `{ shell: true }`, the values are not escaped, only space-separated, which can lead to shell injection.
	4184	+ `{ shell: true }` or `{ shell: '/path/to/shell' }`, the values are not escaped, only space-separated,
	4185	+ which can lead to shell injection.
4185	4186
4186	4187	### DEP0191: `repl.builtinModules`
4187	4188

0 commit comments

Comments

0 (0)