René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Disallow args in child_process execFile/spawn when the shell option is true","articleBody":"The `execFile` and `spawn` functions allow passing the shell option to run a command using a shell. Despite the fact that setting this option to true means that arguments are no longer properly preserved, these functions continue to accept an array of arguments, giving the false impression that there is some isolation/escaping when behind the scenes the arguments are just [concatenated](https://github.com/nodejs/node/blob/f6ce48636b08292baac4fd443399ab9972e1a69b/lib/child_process.js#L614). This can make it trivial to introduce bugs and security issues, and the behavior is also not aligned with `exec` which only accepts a single command string that is passed to the shell. To make this point clearer, invocations like this are currently accepted, which shouldn't be the case:\n\n```javascript\nexecFileSync('echo \"hello', ['world\"'], { shell: true }).toString()\n```","author":{"url":"https://github.com/mohd-akram","@type":"Person","name":"mohd-akram"},"datePublished":"2025-02-20T07:45:05.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":7},"url":"https://github.com/57143/node/issues/57143"}