Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Appearance settings

Commit 97a7728

Browse filesBrowse files
committed
child_process: improve ChildProcess validation
This commit improves input validation for the ChildProcess internals. It became officially supported API a while back, but never had any validation. Refs: #12177 PR-URL: #12348 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Santiago Gimeno <santiago.gimeno@gmail.com>
1 parent 59c6230 commit 97a7728
Copy full SHA for 97a7728

File tree

Expand file treeCollapse file tree

2 files changed

+63
-3
lines changed
Open diff view settings
Filter options
Expand file treeCollapse file tree

2 files changed

+63
-3
lines changed
Open diff view settings
Collapse file

‎lib/internal/child_process.js‎

Copy file name to clipboardExpand all lines: lib/internal/child_process.js
+19-3Lines changed: 19 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -254,6 +254,9 @@ ChildProcess.prototype.spawn = function(options) {
254254
var ipcFd;
255255
var i;
256256

257+
if (options === null || typeof options !== 'object')
258+
throw new TypeError('"options" must be an object');
259+
257260
// If no `stdio` option was given - use default
258261
var stdio = options.stdio || 'pipe';
259262

@@ -265,12 +268,25 @@ ChildProcess.prototype.spawn = function(options) {
265268

266269
if (ipc !== undefined) {
267270
// Let child process know about opened IPC channel
268-
options.envPairs = options.envPairs || [];
271+
if (options.envPairs === undefined)
272+
options.envPairs = [];
273+
else if (!Array.isArray(options.envPairs))
274+
throw new TypeError('"envPairs" must be an array');
275+
269276
options.envPairs.push('NODE_CHANNEL_FD=' + ipcFd);
270277
}
271278

272-
this.spawnfile = options.file;
273-
this.spawnargs = options.args;
279+
if (typeof options.file === 'string')
280+
this.spawnfile = options.file;
281+
else
282+
throw new TypeError('"file" must be a string');
283+
284+
if (Array.isArray(options.args))
285+
this.spawnargs = options.args;
286+
else if (options.args === undefined)
287+
this.spawnargs = [];
288+
else
289+
throw new TypeError('"args" must be an array');
274290

275291
var err = this._handle.spawn(options);
276292

Collapse file

‎test/parallel/test-child-process-constructor.js‎

Copy file name to clipboardExpand all lines: test/parallel/test-child-process-constructor.js
+44Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,50 @@ const assert = require('assert');
55
const { ChildProcess } = require('child_process');
66
assert.strictEqual(typeof ChildProcess, 'function');
77

8+
{
9+
// Verify that invalid options to spawn() throw.
10+
const child = new ChildProcess();
11+
12+
[undefined, null, 'foo', 0, 1, NaN, true, false].forEach((options) => {
13+
assert.throws(() => {
14+
child.spawn(options);
15+
}, /^TypeError: "options" must be an object$/);
16+
});
17+
}
18+
19+
{
20+
// Verify that spawn throws if file is not a string.
21+
const child = new ChildProcess();
22+
23+
[undefined, null, 0, 1, NaN, true, false, {}].forEach((file) => {
24+
assert.throws(() => {
25+
child.spawn({ file });
26+
}, /^TypeError: "file" must be a string$/);
27+
});
28+
}
29+
30+
{
31+
// Verify that spawn throws if envPairs is not an array or undefined.
32+
const child = new ChildProcess();
33+
34+
[null, 0, 1, NaN, true, false, {}, 'foo'].forEach((envPairs) => {
35+
assert.throws(() => {
36+
child.spawn({ envPairs, stdio: ['ignore', 'ignore', 'ignore', 'ipc'] });
37+
}, /^TypeError: "envPairs" must be an array$/);
38+
});
39+
}
40+
41+
{
42+
// Verify that spawn throws if args is not an array or undefined.
43+
const child = new ChildProcess();
44+
45+
[null, 0, 1, NaN, true, false, {}, 'foo'].forEach((args) => {
46+
assert.throws(() => {
47+
child.spawn({ file: 'foo', args });
48+
}, /^TypeError: "args" must be an array$/);
49+
});
50+
}
51+
852
// test that we can call spawn
953
const child = new ChildProcess();
1054
child.spawn({

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.