How to pass arguments/parameters when executing bash/shell script from NodeJS [duplicate]

Question

I have the following code:

exec('sh cert-check-script-delete.sh', req.body.deletedCert);
console.log(req.body.deletedCert);

The console log correctly shows the req.body.deletedCert is non-empty.

And in cert-check-script-delete.sh I have:

#!/bin/sh

certs.json="./"  # Name of JSON file and directory location
echo -e $1 >> certs.json

But it's just writing an empty line to certs.json

I've also tried:

exec('sh cert-check-script-delete.sh' + req.body.deletedCert)

But neither formats work

BTW, is there a reason you aren't giving your file a proper shebang (#!/bin/bash, since echo -e isn't safe with sh), setting the +x bit, and executing it directly without an explicit interpreter? — Charles Duffy
– Charles Duffy, Commented Apr 20, 2018 at 15:16
Try adding a space after .sh, exec('sh cert-check-script-delete.sh ' + req.body.deletedCert) — Dave Carruthers
– Dave Carruthers, Commented Apr 20, 2018 at 15:17
@DaveCarruthers, that's a huge security risk. Let's say someone submits code saying they want to delete the certificate $(rm -rf ~). You never, ever, ever should substitute text from incoming requests into text parsed as part of a shell command. — Charles Duffy
– Charles Duffy, Commented Apr 20, 2018 at 15:18
Thanks for the suggestion but writing it in that format is now not even writing the empty line to certs.json. Also regarding the shebang, I was not aware there were different types of shebangs and I must've just copied and pasted the shebang from online — tnoel999888
– tnoel999888, Commented Apr 20, 2018 at 15:21

2 revs · Accepted Answer · 2018-04-20 16:03:37Z

2

Use execFile(), and pass your arguments out-of-band:

child_process.execFile('./cert-check-script-delete.sh', [req.body.deletedCert])

That way your string (from req.body.deletedCert) is passed as a literal argument, not parsed as code. Note that this requires that your script be successfully marked executable (chmod +x check-cert-script-delete.sh), and that it start with a valid shebang.

If you can't fix your file permissions to make your executable, at least pass the arguments out-of-band:

child_process.execFile('/bin/sh', ['./check-cert-script-delete.sh', req.body.deletedCert])

edited Apr 20, 2018 at 16:03

community wiki

2 revs
Charles Duffy

Sign up to request clarification or add additional context in comments.

5 Comments

tnoel999888 Over a year ago

Thanks for the answer, but where does child_process come from? I have the following variable defined const exec = require('child_process').exec, child;, is this sufficient or do I need to import anything else too?

Charles Duffy Over a year ago

const child_process = require('child_process') will get you the whole module, not just one function from it.

tnoel999888 Over a year ago

Thanks for the suggestion but this still doesn't work, I've used the solution involving the space for now

Charles Duffy Over a year ago

@tnoel999888, re: "doesn't work" -- it's worth digging into the details. Security matters, and if this doesn't work, it's because something else is broken (your file permissions are wrong, or your shebang is invalid, or so forth).

Charles Duffy Over a year ago

@tnoel999888, ...that said, if you really must use a shell, at least do it like so: child_process.execFile('/bin/sh', ['./check-cert-script-delete.sh', req.body.deletedCert])

Collectives™ on Stack Overflow

How to pass arguments/parameters when executing bash/shell script from NodeJS [duplicate]

1 Answer 1

5 Comments

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

5 Comments

Linked

Related