DEV Community

Executing Shell Scripts with NodeJS

Aabhas Sao on March 08, 2022

You might have seen .sh files in many popular GitHub repositories. Even some of you might have used shell file to install node's latest version in ...

Read full post

Anton Golub • Mar 10 '22 • Edited

I think it's important to add a disclaimer: please never use cp api like this. This is extremely unsafe. String literal w/o arg boxing, symbol escaping, etc, provides any RCE.

See how bash-in-js concept is implemented in similar projects.

Aabhas Sao • Mar 10 '22

Thanks @antongolub I didn't knew. The libraries you mentioned seem cool. I would check them out. Why is using child process like this unsafe didn't understood well. Any article ont that?

Anton Golub • Mar 10 '22

Ok, here's a RCE example)

const arg = '"hello" && echo "rm -rf ./ may be here"'
const cmd = `echo ${arg}`

Key tip: you need to understand the boundaries of the arguments and escape the characters that can violate them.

Aabhas Sao • Mar 10 '22

Thanks now I get it. Passing user input in such commands can be dangerous. Similar to the way SQL injection attacks happen by I'll formatted arguments.