Intermediate LevelWeb Security & Cyber Defense
Why is string escaping insufficient for shell commands compared to child_process.execFile()?
❓ Interview Prompt: Explain Command Injection defenses, string shell escaping flaws, NULL byte injection, and process parameterization using `execFile()`.
Attempting to sanitize or escape user inputs passed to system shell functions ('child_process.exec()') is inherently flawed:
Why Shell Escaping Fails:
Operating system shells (bash, sh, cmd.exe) support complex metacharacters, environment variables, NULL bytes ('%00'), and variable expansion syntaxes that bypass regex escaping filters!
•
Solution: Bypass system shells entirely using 'execFile()', which passes parameters directly to the operating system process creation kernel APIs.
Code Implementation Example
typescript
import { execFile } from 'child_process';
// ✅ SECURE: execFile invokes binary directly without executing a shell interpreter
execFile('/usr/bin/convert', ['input.png', '-resize', '100x100', 'output.png'], (err) => {
if (err) console.error('Image processing failed', err);
});💡Executing binaries safely without shell invocation using execFile.
🎯 Interview Key Takeaway
Use execFile to bypass system shell execution entirely and prevent command injection vulnerabilities.
#Command Injection#execFile#Node.js#Intermediate
Back to all Web Security & Cyber Defense Questions→