mirror of
https://github.com/nodejs/node.git
synced 2026-11-09 15:11:11 -05:00
doc: clarify that any truthy value of shell is part of DEP0190
PR-URL: https://github.com/nodejs/node/pull/62249 Reviewed-By: René <contact.9a5d6388@renegade334.me.uk> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
This commit is contained in:
1 parent
7a29409ed3
commit
020d2b5eb9
1 file changed
+3
-2
@@ -3803,7 +3803,7 @@ Type: Documentation-only
|
||||
`process.features.tls_alpn`, `process.features.tls_ocsp`, and `process.features.tls_sni` are
|
||||
deprecated, as their values are guaranteed to be identical to that of `process.features.tls`.
|
||||
|
||||
### DEP0190: Passing `args` to `node:child_process` `execFile`/`spawn` with `shell` option `true`
|
||||
### DEP0190: Passing `args` to `node:child_process` `execFile`/`spawn` with `shell` option
|
||||
|
||||
<!-- YAML
|
||||
changes:
|
||||
@@ -3816,7 +3816,8 @@ changes:
|
||||
Type: Documentation-only
|
||||
|
||||
When an `args` array is passed to [`child_process.execFile`][] or [`child_process.spawn`][] with the option
|
||||
`{ shell: true }`, the values are not escaped, only space-separated, which can lead to shell injection.
|
||||
`{ shell: true }` or `{ shell: '/path/to/shell' }`, the values are not escaped, only space-separated,
|
||||
which can lead to shell injection.
|
||||
|
||||
### DEP0191: `repl.builtinModules`
|
||||
|
||||
|
||||
Reference in new issue
Block a user