child_process: validate exec's options.shell as string
#59185
Conversation
nodejs-github-bot
added
child_process
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #59185 +/- ##
==========================================
+ Coverage 87.76% 88.28% +0.52%
==========================================
Files 701 701
Lines 206774 206780 +6
Branches 39692 39780 +88
==========================================
+ Hits 181477 182563 +1086
+ Misses 17288 16235 -1053
+ Partials 8009 7982 -27
🚀 New features to boost your workflow:
|
| @@ -33,7 +33,7 @@ const testCopy = (shellName, shellPath) => { | |||
| const system32 = `${process.env.SystemRoot}\\System32`; | |||
|
|
|||
| // Test CMD | |||
| test(true); | |||
There was a problem hiding this comment.
shell: true is a widely used input. many downstream devs (and me) are actually using it.
https://github.com/search?q=child_process+shell%3A+true+language%3AJavaScript&type=code&l=JavaScript
So this is a breaking change. I personally unvote this
There was a problem hiding this comment.
On exec() or its sister functions?
This is only adding validation of documented behaviour, which by precedent is not a breaking change – not that it's for me to say.
There was a problem hiding this comment.
yeah, it is string on document. But I think it's too loose before on runtime, now it's hard to make it back
himself65
added
the
semver-major
| if (options.shell != null) { | ||
| if (typeof options.shell !== 'boolean' && typeof options.shell !== 'string') { | ||
| throw new ERR_INVALID_ARG_TYPE('options.shell', | ||
| ['boolean', 'string'], options.shell); | ||
| } | ||
| validateArgumentNullCheck(options.shell, 'options.shell'); |
There was a problem hiding this comment.
Do we have a test for when options.shell is the empty string?
There was a problem hiding this comment.
Not at present, that was the whole conversation that led to #58564. There will be one when we get around to a runtime deprecation.
Renegade334
force-pushed
the
childprocess-exec-validate-shell-argument
branch
from
a355ebf to
4ca3f67
Compare
exec()is documented to only take a string for the shell option, but this is not validated; passing something like{ shell: false }(or any other invalid value) is currently silently ignored. This adds explicit validation.Replaces #58525.