OSSForks/node
1
0
Fork 0
mirror of https://github.com/zebrajr/node.git synced 2026-01-15 12:15:26 +00:00
Code Issues Actions 8 Packages Projects Releases Wiki Activity

doc: deprecate passing args to spawn and execFile

Browse Source 
PR-URL: https://github.com/nodejs/node/pull/57389
Refs: https://github.com/nodejs/node/pull/57199
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Jason Zhang <xzha4350@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
This commit is contained in:
Antoine du Hamel
2025-03-19 11:02:29 +01:00
committed by GitHub
parent fe5817e06c
commit 109c817db6
1 changed files with 17 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
doc/api/deprecations.md
View File

@@ -3855,6 +3855,21 @@ Type: Documentation-only
`process.features.tls_alpn`, `process.features.tls_ocsp`, and `process.features.tls_sni` are
deprecated, as their values are guaranteed to be identical to that of `process.features.tls`.
### DEP0190: Passing `args` to `node:child_process` `execFile`/`spawn` with `shell` option `true`
<!-- YAML
changes:
- version:
- REPLACEME
pr-url: https://github.com/nodejs/node/pull/57389
description: Documentation-only deprecation.
-->
Type: Documentation-only
When an `args` array is passed to [`child_process.execFile`][] or [`child_process.spawn`][] with the option
`{ shell: true }`, the values are not escaped, only space-separated, which can lead to shell injection.
[NIST SP 800-38D]: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf
[RFC 6066]: https://tools.ietf.org/html/rfc6066#section-3
[RFC 8247 Section 2.4]: https://www.rfc-editor.org/rfc/rfc8247#section-2.4
@@ -3882,6 +3897,8 @@ deprecated, as their values are guaranteed to be identical to that of `process.f
[`assert`]: assert.md
[`asyncResource.runInAsyncScope()`]: async_context.md#asyncresourceruninasyncscopefn-thisarg-args
[`buffer.subarray`]: buffer.md#bufsubarraystart-end
[`child_process.execFile`]: child_process.md#child_processexecfilefile-args-options-callback
[`child_process.spawn`]: child_process.md#child_processspawncommand-args-options
[`child_process`]: child_process.md
[`clearInterval()`]: timers.md#clearintervaltimeout
[`clearTimeout()`]: timers.md#cleartimeouttimeout