archive-gh-me/shelljs
1
0
Fork 0
mirror of https://github.com/shelljs/shelljs.git synced 2026-01-18 16:03:37 +00:00
Code Issues Projects Releases Wiki Activity

docs(exec): minor wording changes on security doc (#951)

Browse Source 
This is a follow-up to #950, to emphasize the message.
This commit is contained in:
Nate Fischer 2019-06-26 09:39:24 -07:00 committed by GitHub
parent 68c382221e
commit 7aa8ce4ebd
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 8 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
README.md
View File

@ -340,10 +340,10 @@ Not seeing the behavior you want? `exec()` runs everything through `sh`
by default (or `cmd.exe` on Windows), which differs from `bash`. If you
need bash-specific behavior, try out the `{shell: 'path/to/bash'}` option.
**Note:** as `shell.exec()` executes an arbitrary string in the system
shell, it is **critical** to properly sanitize user input to avoid command
execution. For more context, consult the [Security
guidelines](https://github.com/shelljs/shelljs/wiki/Security-guidelines).
**Security note:** as `shell.exec()` executes an arbitrary string in the
system shell, it is **critical** to properly sanitize user input to avoid
**command injection**. For more context, consult the [Security
Guidelines](https://github.com/shelljs/shelljs/wiki/Security-guidelines).
### find(path [, path ...])

8
src/exec.js
View File

@ -178,10 +178,10 @@ function execAsync(cmd, opts, pipe, callback) {
//@ by default (or `cmd.exe` on Windows), which differs from `bash`. If you
//@ need bash-specific behavior, try out the `{shell: 'path/to/bash'}` option.
//@
//@ **Note:** as `shell.exec()` executes an arbitrary string in the system
//@ shell, it is **critical** to properly sanitize user input to avoid command
//@ execution. For more context, consult the [Security
//@ guidelines](https://github.com/shelljs/shelljs/wiki/Security-guidelines).
//@ **Security note:** as `shell.exec()` executes an arbitrary string in the
//@ system shell, it is **critical** to properly sanitize user input to avoid
//@ **command injection**. For more context, consult the [Security
//@ Guidelines](https://github.com/shelljs/shelljs/wiki/Security-guidelines).
function _exec(command, options, callback) {
options = options || {};
if (!command) common.error('must specify command');