rannn505 / child-shell

Node.js bindings 🔗 for shell
http://rannn505.github.io/child-shell/
MIT License
299 stars 71 forks source link

How to avoid arbitrary command injection #150

Open SirMishaa opened 2 years ago

SirMishaa commented 2 years ago

Hello

I want to execute this command :

Set-Clipboard -Value "Content here"

My issue is that doing something like that :

const command = PowerShell.command(['Set-Clipboard -Value ', `"${content}"`]);

This is a vulnerability because if I execute this command with this content, for example :"Hello World\"; explorer.exe / \"" It will start the explorer.exe process

How can I avoid this kind of issue? Or how can I sanitize the content before executing the command?

The documentation link seems to be broken :/