Skip to main content

Be cautious when working with child processes

One Paragraph Explainer​

As great as child processes are, they should be used with caution. Passing in user input must be sanitized, if not avoided at all. The dangers of unsanitized input executing system-level logic are unlimited, reaching from remote code execution to the exposure of sensitive system data and even data loss. A check list of preparations could look like this

  • avoid user input in every case, otherwise validate and sanitize it
  • limit the privileges of the parent and child processes using user/group identities
  • run your process inside of an isolated environment to prevent unwanted side-effects if the other preparations fail

Code example: Dangers of unsanitized child process executions​

const { exec } = require('child_process');

...

// as an example, take a script that takes two arguments, one of them is unsanitized user input
exec('"/path/to/test file/someScript.sh" --someOption ' + input);

// -> imagine what could happen if the user simply enters something like '&& rm -rf --no-preserve-root /'
// you'd be in for an unwanted surprise

Additional resources​

From the Node.js child process documentation:

Never pass unsanitized user input to this function. Any input containing shell metacharacters may be used to trigger arbitrary command execution.