4 ms·

It's surprising how often this just isn't necessary. The example in the code is one I've often seen in production: const { stdout, stderr } = await exec(`curl

It's surprising how often this just isn't necessary. The example in the code is one I've often seen in production: const { stdout, stderr } = await exec(`curl ${line}`); Javascript has fetch(), PHP has a curl library built into the language, python has requests, etc. The majority of shell() calls have the same exact situation.

Blikkentrekker 5y ago
This is actually a function that is used with any regularity opposed to something almost never used with all the documentation warning against it? Why does it not work so: exec(['curl', line]) Like in about any other language? I don't even see a need or something like that to exist, if one truly must, then one can always use: exec(['/bin/sh', '-c', 'curl ${line}']) Which I assume it resolves under the hood.
- zamadatix 5y ago
  I'm not sure I follow the question. The main difference between the original line and the "why does it not work like so" line is the original is written as an async call and your line is as a sync call but all of that has nothing to do with the question of why call an external binary for something that has a built-in.
  - Blikkentrekker 5y ago
    No, the original is: exec('curl ${line}') Which takes a single string as argument, whereas mine is: exec(['curl', line]) Which takes an array of strings as an argument, which are not parsed by any shell interpreter. Of course, flags can still be passed to curl that way, so the proper way is: exec(['curl', '--', line])
    - maddyboo 5y ago
      Node’s child_process.exec() [0] passes the first argument straight into a shell, so you can use whatever shell features you want. The functionality you’re talking about is provided by child_process.spawn() [1] (as long as the shell option isn’t specified). The exec() documentation actually provides a warning: > Never pass unsanitized user input to this function. Any input containing shell metacharacters may be used to trigger arbitrary command execution. Likewise, spawn() says this: > If the shell option is enabled, do not pass unsanitized user input to this function. Any input containing shell metacharacters may be used to trigger arbitrary command execution. I do think the naming could be better - why isn’t exec() called shell()? [0]: https://nodejs.org/api/child_process.html#child_process_child_process_exec_command_options_callback https://nodejs.org/api/child_process.html#child_process_chil... [1]: https://nodejs.org/api/child_process.html#child_process_child_process_spawn_command_args_options https://nodejs.org/api/child_process.html#child_process_chil...
      - Blikkentrekker 5y ago
        My point is that it should not even exist as it's uses are quite marginal, and it's very easy to go wrong with it. If it really be needed, one can always do something such as: exec(['/bin/sh', '-c', "curl ${line}"])

Blikkentrekker 5y ago

This is actually a function that is used with any regularity opposed to something almost never used with all the documentation warning against it? Why does it not work so: exec(['curl', line]) Like in about any other language? I don't even see a need or something like that to exist, if one truly must, then one can always use: exec(['/bin/sh', '-c', 'curl ${line}']) Which I assume it resolves under the hood.

zamadatix 5y ago
I'm not sure I follow the question. The main difference between the original line and the "why does it not work like so" line is the original is written as an async call and your line is as a sync call but all of that has nothing to do with the question of why call an external binary for something that has a built-in.
- Blikkentrekker 5y ago
  No, the original is: exec('curl ${line}') Which takes a single string as argument, whereas mine is: exec(['curl', line]) Which takes an array of strings as an argument, which are not parsed by any shell interpreter. Of course, flags can still be passed to curl that way, so the proper way is: exec(['curl', '--', line])
  - maddyboo 5y ago
    Node’s child_process.exec() [0] passes the first argument straight into a shell, so you can use whatever shell features you want. The functionality you’re talking about is provided by child_process.spawn() [1] (as long as the shell option isn’t specified). The exec() documentation actually provides a warning: > Never pass unsanitized user input to this function. Any input containing shell metacharacters may be used to trigger arbitrary command execution. Likewise, spawn() says this: > If the shell option is enabled, do not pass unsanitized user input to this function. Any input containing shell metacharacters may be used to trigger arbitrary command execution. I do think the naming could be better - why isn’t exec() called shell()? [0]: https://nodejs.org/api/child_process.html#child_process_child_process_exec_command_options_callback https://nodejs.org/api/child_process.html#child_process_chil... [1]: https://nodejs.org/api/child_process.html#child_process_child_process_spawn_command_args_options https://nodejs.org/api/child_process.html#child_process_chil...
    - Blikkentrekker 5y ago
      My point is that it should not even exist as it's uses are quite marginal, and it's very easy to go wrong with it. If it really be needed, one can always do something such as: exec(['/bin/sh', '-c', "curl ${line}"])