Escaping shell arguments to exec()

First of all, I just want to say thanks for writing shelljs. It cleans up my code a lot.

I need to invoke commands with shell.exec(), however, those commands will include some input from external sources, to be passed as arguments to system executables. Is there a “safe” way to do this? I was hoping for the classic array syntax, like:

shell.exec(["ls", "-l", "/some/path"])

Though this doesn’t seem to be implemented. It doesn’t appear nodejs itself even has a shell escape function neither. Any plans on this front?

[cscott]

Please. Providing only a string argument here is a recipe for disaster, honestly. As pointed out, it’s basically impossible to “properly” quote any arguments given. As is, exec is vulnerable to file names containing spaces, special characters, semicolons, the works. Cf http://www.dwheeler.com/secure-programs/Secure-Programs-HOWTO/handle-metacharacters.html and the “motivation” section of (for example) https://www.python.org/dev/peps/pep-0324/. A security-conscious API should strongly encourage providing arguments as an array by default.

[OmgImAlexis]

Are there any updates on this? This has been open for 3 years now.

Ref: https://snyk.io/vuln/npm:shelljs:20140723