3 ms·
No, the original is: exec('curl ${line}') Which takes a single string as argument, whereas mine is: exec(['curl', line]) Which takes an array of strin
by Blikkentrekker 5y ago
No, the original is:
exec('curl ${line}')
Which takes a single string as argument, whereas mine is:
exec(['curl', line])
Which takes an array of strings as an argument, which are not parsed by any shell interpreter.
Of course, flags can still be passed to curl that way, so the proper way is:
exec(['curl', '--', line])
- maddyboo 5y agoNode’s child_process.exec() [0] passes the first argument straight into a shell, so you can use whatever shell features you want. The functionality you’re talking about is provided by child_process.spawn() [1] (as long as the shell option isn’t specified). The exec() documentation actually provides a warning: > Never pass unsanitized user input to this function. Any input containing shell metacharacters may be used to trigger arbitrary command execution. Likewise, spawn() says this: > If the shell option is enabled, do not pass unsanitized user input to this function. Any input containing shell metacharacters may be used to trigger arbitrary command execution. I do think the naming could be better - why isn’t exec() called shell()? [0]: https://nodejs.org/api/child_process.html#child_process_child_process_exec_command_options_callback https://nodejs.org/api/child_process.html#child_process_chil... [1]: https://nodejs.org/api/child_process.html#child_process_child_process_spawn_command_args_options https://nodejs.org/api/child_process.html#child_process_chil...
- Blikkentrekker 5y agoMy point is that it should not even exist as it's uses are quite marginal, and it's very easy to go wrong with it. If it really be needed, one can always do something such as: exec(['/bin/sh', '-c', "curl ${line}"])