How do I escape a string for a shell command in node?
Solution 1
There is a way to write to an external command: process.createChildProcess
(documentation) returns an object with a write
method. createChildProcess
isn't as convenient though, because it doesn't buffer stdout and stderr, so you will need event handlers to read the output in chunks.
var stdout = "", stderr = "";
var child = process.createChildProcess("someCommand");
child.addListener("output", function (data) {
if (data !== null) {
stdout += data;
}
});
child.addListener("error", function (data) {
if (data !== null) {
stderr += data;
}
});
child.addListener("exit", function (code) {
if (code === 0) {
sys.puts(stdout);
}
else {
// error
}
});
child.write("This goes to someCommand's stdin.");
Solution 2
This is what I use:
var escapeShell = function(cmd) {
return '"'+cmd.replace(/(["'$`\\])/g,'\\$1')+'"';
};
Solution 3
You should never rely on escaping unknown input going to a shell parameter - there will almost always be some edge-case that you haven't thought of that allows the user to execute arbitrary code on your server.
Node has support for calling a command and passing each argument separately, with no escaping required. This is the safest way to do it:
const { spawn } = require('child_process');
// Note that the arguments are in an array, not using string interpolation
const ls = spawn('ls', ['-lh', '/usr']);
ls.stdout.on('data', (data) => {
console.log(`stdout: ${data}`);
});
ls.stderr.on('data', (data) => {
console.log(`stderr: ${data}`);
});
ls.on('close', (code) => {
console.log(`child process exited with code ${code}`);
});
The documentation is here
Solution 4
If you need simple (yet correct) solution you can use this:
function escapeShellArg (arg) {
return `'${arg.replace(/'/g, `'\\''`)}'`;
}
So your string will be simply escaped with single quotes as Chris Johnsen mentioned.
echo 'John'\''s phone';
It works in bash
because of strong quoting, feels like it also works in fish
, but does not work in zsh
and sh
.
If you have bash
your can run your script in sh
or zsh
with 'bash -c \'' + escape('all-the-rest-escaped') + '\''
.
But actually... node.js will escape all needed characters for you:
var child = require('child_process')
.spawn('echo', ['`echo 1`;"echo $SSH_TTY;\'\\0{0..5}']);
child.stdout.on('data', function (data) {
console.log('stdout: ' + data);
});
child.stderr.on('data', function (data) {
console.log('stderr: ' + data);
});
this block of code will execute:
echo '`echo 1`;"echo $SSH_TTY;'\''\\0{0..5}'
and will output:
stdout: `echo 1`;"echo $SSH_TTY;\'\\0{0..5}
or some error.
Take a look at http://nodejs.org/api/child_process.html#child_process_child_process_spawn_command_args_options
By the way simple solution to run a bunch of commands is:
require('child_process')
.spawn('sh', ['-c', [
'cd all/your/commands',
'ls here',
'echo "and even" > more'
].join('; ')]);
Have a nice day!
Solution 5
I second the opinion of Will, whenever possible you should avoid escaping by hand and prefer spawn.
However, in the case that escaping is unavoidable, for example if you need to use exec or you are executing a command through ssh. Then you can use base64 to pass safe characters to bash and rely on bash to escape the unknown.
const dangerStr = 'bad stuff here'
// base64 has safe characters [A-Za-z=0-9+/]
const dangerBase64 = btoa(dangerStr)
sys.exec(`echo "$(echo ${dangerBase64} | base64 -d)" | somecommand`)
The explanation is the following:
dangerBase64
is unknown but it does not contain unsafe characters in bash. Hence echo ${dangerBase64}
will output what we want.
Finally the double quote around $(echo ${dangerBase64} | base64 -d)
escape the actual value passed by the user inside bash, which is safe and has the same value that the user wanted.
Maciek
Updated on January 20, 2022Comments
-
Maciek over 2 years
In nodejs, the only way to execute external commands is via sys.exec(cmd). I'd like to call an external command and give it data via stdin. In nodejs there does yet not appear to be a way to open a command and then push data to it (only to exec and receive its standard+error outputs), so it appears the only way I've got to do this right now is via a single string command such as:
var dangerStr = "bad stuff here"; sys.exec("echo '" + dangerStr + "' | somecommand");
Most answers to questions like this have focused on either regex which doesn't work for me in nodejs (which uses Google's V8 Javascript engine) or native features from other languages like Python.
I'd like to escape dangerStr so that it's safe to compose an exec string like the one above. If it helps, dangerStr will contain JSON data.
-
grilix almost 12 yearsInteresting.. Thanks! BTW, The new URI is nodejs.org/api/child_process.html
-
Will over 11 yearsYou don't explain anything about escaping arguments.
-
nonrectangular over 10 yearsThis does not answer what the OP asked about, which is escaping arguments. The use of
echo
was just an example. The OP is not just trying to pipe a string to a command. They're trying to use an arbitrary string at the command-line. -
Matthew Crumley over 10 yearsIt doesn't answer the question in the title, but this solves the problem by avoiding the issue completely. The OP accepted the answer, so apparently it helped.
-
David Torres almost 9 yearsWhat is doing the first $? In the api reference says that matches only if is the end of the string, but it is not this case. I tried the string "/aPath'/with/qu'otes'" (notice it ends with single quote + double), with $ and without $. The outcome is the same.
-
Konstantin Tarkus over 8 years@DavidTorres
abc$abc
becomesabc\$abc
-
Alex Yaroshevich over 7 yearsNo need to esacpe
$
if use apostrophe'
-
Admin almost 7 yearsWhy do the other quote types need escaping at all? Surely only the type of quote being used poses a danger.
-
Anders Kaseorg almost 7 yearsThis seems wrong: it escapes
foo bar
as"foo\ bar"
, which will be parsed asfoo\ bar
. -
Mecki over 5 years@AlexYaroshevich If you use apostrophe, you cannot use backslash encoding at all as backslash is an ordinary character within apostrophes. How would you then escape an apostrophe character in the string? Right, you can't. That's why you should not use apostrophe for strings that may contain an apostrophe.
-
Mecki over 5 yearsQuoting whitespace (
\s
) is unnecessary if you wrap everything in double quotes as that will automatically retain all whitespace. You would only need to do that if there were no quotes around the string otherwise space is seen as an argument separator by the shell. Also you are not quoting space correctly as you turn a tab into\
but the correct form would be\t
. -
Cully over 5 yearsThis seems like an invitation for command injection and weird edge case issues.