How to avoid command injection in node child_process exec

Question

I am opening IE browser in(via) my electron application using Node child_process. Code below:

var cp = require('child_process');      
var browser = cp.exec('start', 'iexplore', ['-private', args.url]);

This is raising command injection warning when I run Fortify analysis on this code. Also, this args.url is fetched from api resource (stored in db) and is not related to any user input on this client application.

Please help me escape this. I also tried spawn, but no success.

securecodeninja · Accepted Answer · 2020-10-04 01:20:43Z

2

As a rule of thumb, you must not trust any type of input regardless if it was user provided or pulled from the DB.

Avoid using the exec() function and use execFile() instead. The execFile() function will execute a single command and does not spawn a shell by default which makes it safer than exec()

var cp = require('child_process');      
var browser = cp.execFile('iexplore', ['-private', args.url]);

answered Oct 4, 2020 at 1:20

securecodeninja

2,5253 gold badges19 silver badges24 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Sachet Gupta Over a year ago

still no success

Collectives™ on Stack Overflow

How to avoid command injection in node child_process exec

1 Answer 1

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related