Avoid command injection

This page is not yet available in Spanish. We are working on its translation.
If you have any questions or feedback about our current translation project, feel free to reach out to us!

Metadata

ID: typescript-node-security/command-injection

Language: TypeScript

Severity: Warning

Category: Security

CWE: 78

Description

When executing a command, never use unchecked variables. Make sure that each variable of the command has been checked.

Non-Compliant Code Examples

childprocess.exec(`mv ${src} ${dst}`, (error, stdout, stderr) => {});
childprocess.exec('mv ' + src + " " + dst, (error, stdout, stderr) => {});

Compliant Code Examples

childprocess.exec('mv /tmp/src /tmp/dst', (error, stdout, stderr) => {});
https://static.datadoghq.com/static/images/logos/github_avatar.svg https://static.datadoghq.com/static/images/logos/vscode_avatar.svg jetbrains

Seamless integrations. Try Datadog Code Analysis