News for hackers. Stuff that matters.

A comment on Critical vulnerability of NPM package macaddress. Parent comment

Re:Critical vulnerability of NPM package macaddress by yes_or_gnome on Monday June 11, 2018 @11:07PM (#17290429)
I'm not a JS developer, so this as much of a question as it is a statement.

`exec` is a system call and doesn't call bash or any other shell. At least, it shouldn't.

If it does, then it would be wrong to assume that bash is even available.

Either way. The single quote sytax is specific to bash (and maybe sh, dash, etc. I'm not certain.) so, don't rely upon it.

[ Parent | on HN ]
Re:Critical vulnerability of NPM package macaddress by tomxor on Tuesday June 12, 2018 @09:04AM (#17292798)
You are describing execFile in nodejs which directly spawns a binary into a child process and explicitly passes each argument from an array (Other's here have mentioned it's the prefered way as it obviously avoids any arbitrary execution potential of going through a shell)...

exec is not a system call in nodejs, it's just a convenience function that sets up a child process and spawns a shell (of your choosing) and then passes the first argument as the single command.

[ Parent | on HN ]