{"action":"created","comment":{"url":"https://api.github.com/repos/nodejs/node/pulls/comments/232365235","pull_request_review_id":173554914,"id":232365235,"node_id":"MDI0OlB1bGxSZXF1ZXN0UmV2aWV3Q29tbWVudDIzMjM2NTIzNQ==","diff_hunk":"@@ -48,6 +48,26 @@ command.on('close', common.mustCall((code, signal) => {\n   assert.strictEqual(commandOutput.trim(), 'bar');\n }));\n \n+// Verify that shell features can not be passed through","path":"test/parallel/test-child-process-spawn-shell.js","position":4,"original_position":4,"commit_id":"91e1dd4d83a468ba1fadc439091eeb50a0c53868","original_commit_id":"91e1dd4d83a468ba1fadc439091eeb50a0c53868","user":{"login":"lirantal","id":316371,"node_id":"MDQ6VXNlcjMxNjM3MQ==","avatar_url":"https://avatars1.githubusercontent.com/u/316371?v=4","gravatar_id":"","url":"https://api.github.com/users/lirantal","html_url":"https://github.com/lirantal","followers_url":"https://api.github.com/users/lirantal/followers","following_url":"https://api.github.com/users/lirantal/following{/other_user}","gists_url":"https://api.github.com/users/lirantal/gists{/gist_id}","starred_url":"https://api.github.com/users/lirantal/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lirantal/subscriptions","organizations_url":"https://api.github.com/users/lirantal/orgs","repos_url":"https://api.github.com/users/lirantal/repos","events_url":"https://api.github.com/users/lirantal/events{/privacy}","received_events_url":"https://api.github.com/users/lirantal/received_events","type":"User","site_admin":false},"body":"Yep. Should I add a comment to specify why, or should I instead wrap the rest of the test cases also? Looks like the other test cases are not sharing any state or data between them so perhaps wrap them too for consistency?","created_at":"2018-11-09T19:22:12Z","updated_at":"2018-11-09T19:22:13Z","html_url":"https://github.com/nodejs/node/pull/24267#discussion_r232365235","pull_request_url":"https://api.github.com/repos/nodejs/node/pulls/24267","author_association":"MEMBER","_links":{"self":{"href":"https://api.github.com/repos/nodejs/node/pulls/comments/232365235"},"html":{"href":"https://github.com/nodejs/node/pull/24267#discussion_r232365235"},"pull_request":{"href":"https://api.github.com/repos/nodejs/node/pulls/24267"}},"in_reply_to_id":232262928},"pull_request":{"url":"https://api.github.com/repos/nodejs/node/pulls/24267","id":229613129,"node_id":"MDExOlB1bGxSZXF1ZXN0MjI5NjEzMTI5","html_url":"https://github.com/nodejs/node/pull/24267","diff_url":"https://github.com/nodejs/node/pull/24267.diff","patch_url":"https://github.com/nodejs/node/pull/24267.patch","issue_url":"https://api.github.com/repos/nodejs/node/issues/24267","number":24267,"state":"open","locked":false,"title":"Fixing child_process module to check values passed strictly to the options object","user":{"login":"lirantal","id":316371,"node_id":"MDQ6VXNlcjMxNjM3MQ==","avatar_url":"https://avatars1.githubusercontent.com/u/316371?v=4","gravatar_id":"","url":"https://api.github.com/users/lirantal","html_url":"https://github.com/lirantal","followers_url":"https://api.github.com/users/lirantal/followers","following_url":"https://api.github.com/users/lirantal/following{/other_user}","gists_url":"https://api.github.com/users/lirantal/gists{/gist_id}","starred_url":"https://api.github.com/users/lirantal/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lirantal/subscriptions","organizations_url":"https://api.github.com/users/lirantal/orgs","repos_url":"https://api.github.com/users/lirantal/repos","events_url":"https://api.github.com/users/lirantal/events{/privacy}","received_events_url":"https://api.github.com/users/lirantal/received_events","type":"User","site_admin":false},"body":"## Issue\r\n\r\nThe way the `child_process` module currently works with validating the extra options passed to it is by accessing the properties on the options object. However, there is no strict check to validate that the property has been defined on the direct object, and so what happens is that when accessing the property it will bubble up to the prototype chain until it hits the Object prototype and use that.\r\n\r\nIt draws attention to a possible security implication where-as the prototype chain can be manipulated and thus triggering a further vulnerability with the `child_process` module to execute via shell expansion which allows to execute arbitrary commands.\r\n\r\n## Reproduce\r\n\r\nSteps To Reproduce:\r\n1. Create a snippet file as follows:\r\n\r\n```\r\n  const { spawn } = require('child_process');\r\n  Object.prototype.shell = true;\r\n  const cmd = 'ls'\r\n  const args = ['; echo baz']\r\n  const ls = spawn(cmd, args, {stdio: 'inherit'}, function(a,b,c) {\r\n    console.log(a, b, c)\r\n  });\r\n```\r\n2. Run it\r\n3. Observe the baz word added to the output even though the options passed to spawn don't directly include the `shell` option\r\n\r\n##### Checklist\r\n<!-- Remove items that do not apply. For completed items, change [ ] to [x]. -->\r\n\r\n- [x] `make -j4 test` (UNIX), or `vcbuild test` (Windows) passes\r\n- [x] tests and/or benchmarks are included\r\n- [ ] documentation is changed or added\r\n- [ ] commit message follows [commit guidelines](https://github.com/nodejs/node/blob/master/doc/guides/contributing/pull-requests.md#commit-message-guidelines)\r\n","created_at":"2018-11-09T07:50:26Z","updated_at":"2018-11-09T19:22:13Z","closed_at":null,"merged_at":null,"merge_commit_sha":"db80dffd08d0baeaba28b5e3f3adf0bf22989e28","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[{"id":155267478,"node_id":"MDU6TGFiZWwxNTUyNjc0Nzg=","url":"https://api.github.com/repos/nodejs/node/labels/child_process","name":"child_process","color":"f7c6c7","default":false},{"id":169485514,"node_id":"MDU6TGFiZWwxNjk0ODU1MTQ=","url":"https://api.github.com/repos/nodejs/node/labels/semver-major","name":"semver-major","color":"fbca04","default":false}],"milestone":null,"commits_url":"https://api.github.com/repos/nodejs/node/pulls/24267/commits","review_comments_url":"https://api.github.com/repos/nodejs/node/pulls/24267/comments","review_comment_url":"https://api.github.com/repos/nodejs/node/pulls/comments{/number}","comments_url":"https://api.github.com/repos/nodejs/node/issues/24267/comments","statuses_url":"https://api.github.com/repos/nodejs/node/statuses/91e1dd4d83a468ba1fadc439091eeb50a0c53868","head":{"label":"lirantal:fix/child_process_options","ref":"fix/child_process_options","sha":"91e1dd4d83a468ba1fadc439091eeb50a0c53868","user":{"login":"lirantal","id":316371,"node_id":"MDQ6VXNlcjMxNjM3MQ==","avatar_url":"https://avatars1.githubusercontent.com/u/316371?v=4","gravatar_id":"","url":"https://api.github.com/users/lirantal","html_url":"https://github.com/lirantal","followers_url":"https://api.github.com/users/lirantal/followers","following_url":"https://api.github.com/users/lirantal/following{/other_user}","gists_url":"https://api.github.com/users/lirantal/gists{/gist_id}","starred_url":"https://api.github.com/users/lirantal/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lirantal/subscriptions","organizations_url":"https://api.github.com/users/lirantal/orgs","repos_url":"https://api.github.com/users/lirantal/repos","events_url":"https://api.github.com/users/lirantal/events{/privacy}","received_events_url":"https://api.github.com/users/lirantal/received_events","type":"User","site_admin":false},"repo":{"id":151483612,"node_id":"MDEwOlJlcG9zaXRvcnkxNTE0ODM2MTI=","name":"node","full_name":"lirantal/node","private":false,"owner":{"login":"lirantal","id":316371,"node_id":"MDQ6VXNlcjMxNjM3MQ==","avatar_url":"https://avatars1.githubusercontent.com/u/316371?v=4","gravatar_id":"","url":"https://api.github.com/users/lirantal","html_url":"https://github.com/lirantal","followers_url":"https://api.github.com/users/lirantal/followers","following_url":"https://api.github.com/users/lirantal/following{/other_user}","gists_url":"https://api.github.com/users/lirantal/gists{/gist_id}","starred_url":"https://api.github.com/users/lirantal/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lirantal/subscriptions","organizations_url":"https://api.github.com/users/lirantal/orgs","repos_url":"https://api.github.com/users/lirantal/repos","events_url":"https://api.github.com/users/lirantal/events{/privacy}","received_events_url":"https://api.github.com/users/lirantal/received_events","type":"User","site_admin":false},"html_url":"https://github.com/lirantal/node","description":"Node.js JavaScript runtime :sparkles::turtle::rocket::sparkles:","fork":true,"url":"https://api.github.com/repos/lirantal/node","forks_url":"https://api.github.com/repos/lirantal/node/forks","keys_url":"https://api.github.com/repos/lirantal/node/keys{/key_id}","collaborators_url":"https://api.github.com/repos/lirantal/node/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/lirantal/node/teams","hooks_url":"https://api.github.com/repos/lirantal/node/hooks","issue_events_url":"https://api.github.com/repos/lirantal/node/issues/events{/number}","events_url":"https://api.github.com/repos/lirantal/node/events","assignees_url":"https://api.github.com/repos/lirantal/node/assignees{/user}","branches_url":"https://api.github.com/repos/lirantal/node/branches{/branch}","tags_url":"https://api.github.com/repos/lirantal/node/tags","blobs_url":"https://api.github.com/repos/lirantal/node/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/lirantal/node/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/lirantal/node/git/refs{/sha}","trees_url":"https://api.github.com/repos/lirantal/node/git/trees{/sha}","statuses_url":"https://api.github.com/repos/lirantal/node/statuses/{sha}","languages_url":"https://api.github.com/repos/lirantal/node/languages","stargazers_url":"https://api.github.com/repos/lirantal/node/stargazers","contributors_url":"https://api.github.com/repos/lirantal/node/contributors","subscribers_url":"https://api.github.com/repos/lirantal/node/subscribers","subscription_url":"https://api.github.com/repos/lirantal/node/subscription","commits_url":"https://api.github.com/repos/lirantal/node/commits{/sha}","git_commits_url":"https://api.github.com/repos/lirantal/node/git/commits{/sha}","comments_url":"https://api.github.com/repos/lirantal/node/comments{/number}","issue_comment_url":"https://api.github.com/repos/lirantal/node/issues/comments{/number}","contents_url":"https://api.github.com/repos/lirantal/node/contents/{+path}","compare_url":"https://api.github.com/repos/lirantal/node/compare/{base}...{head}","merges_url":"https://api.github.com/repos/lirantal/node/merges","archive_url":"https://api.github.com/repos/lirantal/node/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/lirantal/node/downloads","issues_url":"https://api.github.com/repos/lirantal/node/issues{/number}","pulls_url":"https://api.github.com/repos/lirantal/node/pulls{/number}","milestones_url":"https://api.github.com/repos/lirantal/node/milestones{/number}","notifications_url":"https://api.github.com/repos/lirantal/node/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/lirantal/node/labels{/name}","releases_url":"https://api.github.com/repos/lirantal/node/releases{/id}","deployments_url":"https://api.github.com/repos/lirantal/node/deployments","created_at":"2018-10-03T21:36:17Z","updated_at":"2018-10-16T11:48:29Z","pushed_at":"2018-11-09T07:31:25Z","git_url":"git://github.com/lirantal/node.git","ssh_url":"git@github.com:lirantal/node.git","clone_url":"https://github.com/lirantal/node.git","svn_url":"https://github.com/lirantal/node","homepage":"https://nodejs.org","size":428409,"stargazers_count":0,"watchers_count":0,"language":"JavaScript","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"open_issues_count":0,"license":{"key":"other","name":"Other","spdx_id":"NOASSERTION","url":null,"node_id":"MDc6TGljZW5zZTA="},"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"nodejs:master","ref":"master","sha":"83410d6ac84e4e85cc4f385461c4f0716fd1f836","user":{"login":"nodejs","id":9950313,"node_id":"MDEyOk9yZ2FuaXphdGlvbjk5NTAzMTM=","avatar_url":"https://avatars3.githubusercontent.com/u/9950313?v=4","gravatar_id":"","url":"https://api.github.com/users/nodejs","html_url":"https://github.com/nodejs","followers_url":"https://api.github.com/users/nodejs/followers","following_url":"https://api.github.com/users/nodejs/following{/other_user}","gists_url":"https://api.github.com/users/nodejs/gists{/gist_id}","starred_url":"https://api.github.com/users/nodejs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nodejs/subscriptions","organizations_url":"https://api.github.com/users/nodejs/orgs","repos_url":"https://api.github.com/users/nodejs/repos","events_url":"https://api.github.com/users/nodejs/events{/privacy}","received_events_url":"https://api.github.com/users/nodejs/received_events","type":"Organization","site_admin":false},"repo":{"id":27193779,"node_id":"MDEwOlJlcG9zaXRvcnkyNzE5Mzc3OQ==","name":"node","full_name":"nodejs/node","private":false,"owner":{"login":"nodejs","id":9950313,"node_id":"MDEyOk9yZ2FuaXphdGlvbjk5NTAzMTM=","avatar_url":"https://avatars3.githubusercontent.com/u/9950313?v=4","gravatar_id":"","url":"https://api.github.com/users/nodejs","html_url":"https://github.com/nodejs","followers_url":"https://api.github.com/users/nodejs/followers","following_url":"https://api.github.com/users/nodejs/following{/other_user}","gists_url":"https://api.github.com/users/nodejs/gists{/gist_id}","starred_url":"https://api.github.com/users/nodejs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nodejs/subscriptions","organizations_url":"https://api.github.com/users/nodejs/orgs","repos_url":"https://api.github.com/users/nodejs/repos","events_url":"https://api.github.com/users/nodejs/events{/privacy}","received_events_url":"https://api.github.com/users/nodejs/received_events","type":"Organization","site_admin":false},"html_url":"https://github.com/nodejs/node","description":"Node.js JavaScript runtime :sparkles::turtle::rocket::sparkles:","fork":false,"url":"https://api.github.com/repos/nodejs/node","forks_url":"https://api.github.com/repos/nodejs/node/forks","keys_url":"https://api.github.com/repos/nodejs/node/keys{/key_id}","collaborators_url":"https://api.github.com/repos/nodejs/node/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/nodejs/node/teams","hooks_url":"https://api.github.com/repos/nodejs/node/hooks","issue_events_url":"https://api.github.com/repos/nodejs/node/issues/events{/number}","events_url":"https://api.github.com/repos/nodejs/node/events","assignees_url":"https://api.github.com/repos/nodejs/node/assignees{/user}","branches_url":"https://api.github.com/repos/nodejs/node/branches{/branch}","tags_url":"https://api.github.com/repos/nodejs/node/tags","blobs_url":"https://api.github.com/repos/nodejs/node/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/nodejs/node/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/nodejs/node/git/refs{/sha}","trees_url":"https://api.github.com/repos/nodejs/node/git/trees{/sha}","statuses_url":"https://api.github.com/repos/nodejs/node/statuses/{sha}","languages_url":"https://api.github.com/repos/nodejs/node/languages","stargazers_url":"https://api.github.com/repos/nodejs/node/stargazers","contributors_url":"https://api.github.com/repos/nodejs/node/contributors","subscribers_url":"https://api.github.com/repos/nodejs/node/subscribers","subscription_url":"https://api.github.com/repos/nodejs/node/subscription","commits_url":"https://api.github.com/repos/nodejs/node/commits{/sha}","git_commits_url":"https://api.github.com/repos/nodejs/node/git/commits{/sha}","comments_url":"https://api.github.com/repos/nodejs/node/comments{/number}","issue_comment_url":"https://api.github.com/repos/nodejs/node/issues/comments{/number}","contents_url":"https://api.github.com/repos/nodejs/node/contents/{+path}","compare_url":"https://api.github.com/repos/nodejs/node/compare/{base}...{head}","merges_url":"https://api.github.com/repos/nodejs/node/merges","archive_url":"https://api.github.com/repos/nodejs/node/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/nodejs/node/downloads","issues_url":"https://api.github.com/repos/nodejs/node/issues{/number}","pulls_url":"https://api.github.com/repos/nodejs/node/pulls{/number}","milestones_url":"https://api.github.com/repos/nodejs/node/milestones{/number}","notifications_url":"https://api.github.com/repos/nodejs/node/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/nodejs/node/labels{/name}","releases_url":"https://api.github.com/repos/nodejs/node/releases{/id}","deployments_url":"https://api.github.com/repos/nodejs/node/deployments","created_at":"2014-11-26T19:57:11Z","updated_at":"2018-11-09T18:23:43Z","pushed_at":"2018-11-09T19:16:05Z","git_url":"git://github.com/nodejs/node.git","ssh_url":"git@github.com:nodejs/node.git","clone_url":"https://github.com/nodejs/node.git","svn_url":"https://github.com/nodejs/node","homepage":"https://nodejs.org","size":430818,"stargazers_count":55248,"watchers_count":55248,"language":"JavaScript","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":12087,"mirror_url":null,"archived":false,"open_issues_count":938,"license":{"key":"other","name":"Other","spdx_id":"NOASSERTION","url":null,"node_id":"MDc6TGljZW5zZTA="},"forks":12087,"open_issues":938,"watchers":55248,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/nodejs/node/pulls/24267"},"html":{"href":"https://github.com/nodejs/node/pull/24267"},"issue":{"href":"https://api.github.com/repos/nodejs/node/issues/24267"},"comments":{"href":"https://api.github.com/repos/nodejs/node/issues/24267/comments"},"review_comments":{"href":"https://api.github.com/repos/nodejs/node/pulls/24267/comments"},"review_comment":{"href":"https://api.github.com/repos/nodejs/node/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/nodejs/node/pulls/24267/commits"},"statuses":{"href":"https://api.github.com/repos/nodejs/node/statuses/91e1dd4d83a468ba1fadc439091eeb50a0c53868"}},"author_association":"MEMBER"}}
{"actor":{"display_login":"lirantal"}}