Uh oh!
There was an error while loading. Please reload this page.
child_process: validate exec's options.shell as string - #59185
child_process: validate exec's options.shell as string#59185Renegade334 wants to merge 1 commit into
options.shell as string#59185Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@## main #59185 +/- ##
==========================================
+ Coverage 87.76% 88.28% +0.52%
==========================================
Files 701 701 Lines 206774 206780 +6 Branches 39692 39780 +88 ==========================================
+ Hits 181477 182563 +1086 + Misses 17288 16235 -1053 + Partials 8009 7982 -27
🚀 New features to boost your workflow:
|
nodejs-github-bot
commented
Jul 24, 2025
| @@ -33,7 +33,7 @@ const testCopy = (shellName, shellPath) => { | |||
| const system32 = `${process.env.SystemRoot}\\System32`; | |||
| // Test CMD | |||
| test(true); | |||
There was a problem hiding this comment.
shell: true is a widely used input. many downstream devs (and me) are actually using it.
https://github.com/search?q=child_process+shell%3A+true+language%3AJavaScript&type=code&l=JavaScript
So this is a breaking change. I personally unvote this
There was a problem hiding this comment.
On exec() or its sister functions?
This is only adding validation of documented behaviour, which by precedent is not a breaking change – not that it's for me to say.
There was a problem hiding this comment.
yeah, it is string on document. But I think it's too loose before on runtime, now it's hard to make it back
Uh oh!
There was an error while loading. Please reload this page.
| if (options.shell != null) { | ||
| if (typeof options.shell !== 'boolean' && typeof options.shell !== 'string') { | ||
| throw new ERR_INVALID_ARG_TYPE('options.shell', | ||
| ['boolean', 'string'], options.shell); | ||
| } | ||
| validateArgumentNullCheck(options.shell, 'options.shell'); |
There was a problem hiding this comment.
Do we have a test for when options.shell is the empty string?
There was a problem hiding this comment.
Not at present, that was the whole conversation that led to #58564. There will be one when we get around to a runtime deprecation.
a355ebf to
4ca3f67Compare
exec()is documented to only take a string for the shell option, but this is not validated; passing something like{ shell: false }(or any other invalid value) is currently silently ignored. This adds explicit validation.Replaces #58525.