[vishalshetagar]

Description of the fix

js/command-line-injection now reports remote input that reaches the argument array of spawn/execFile when the shell option is set to true or a nonempty string, including their synchronous variants.

const cp = require("child_process");
const app = require("express")();

app.get("/a", (req, res) => {
  cp.exec("echo hello " + req.query.name); // reported
  res.send("ok");
});

app.get("/b", (req, res) => {
  cp.spawn("echo", ["hello", req.query.name], { shell: true }); // now reported
  res.send("ok");
});

app.get("/c", (req, res) => {
  cp.spawn("echo", ["hello", req.query.name], { shell: "/bin/sh" }); // now reported
  res.send("ok");
});

All three routes are now reported by js/command-line-injection. Argument arrays in these examples with shell: false, shell: "", or no shell option remain unreported.

For child_process.spawn, spawnSync, execFile, and execFileSync, the command-injection sink modeling now reuses UnsafeShellCommandConstruction::ShellTrueCommandExecutionSink for shell-interpreted argument arrays. executesArrayAsShell also recognizes nonempty string-valued shell paths, so js/shell-command-constructed-from-input handles those calls as well. The child_process model recognizes the options argument in execFile calls with or without a callback.

Testing

Regression checks cover boolean and string-valued shell options, synchronous variants, callbacks, promisified calls, and argument arrays built with push and unshift. Negative cases cover disabled or omitted shell options and constant arguments.

All 66 targeted checks and the existing CommandInjection and UnsafeShellCommandConstruction query test suites pass.

Fixes #22825.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.