Skip to content

Commit 69d3754

Browse files
authored
doc: clarify that any truthy value of shell is part of DEP0190
PR-URL: #62249 Reviewed-By: René <contact.9a5d6388@renegade334.me.uk> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
1 parent 4579957 commit 69d3754

File tree

1 file changed

+3
-2
lines changed

1 file changed

+3
-2
lines changed

doc/api/deprecations.md

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4175,7 +4175,7 @@ Type: Documentation-only
41754175
`process.features.tls_alpn`, `process.features.tls_ocsp`, and `process.features.tls_sni` are
41764176
deprecated, as their values are guaranteed to be identical to that of `process.features.tls`.
41774177

4178-
### DEP0190: Passing `args` to `node:child_process` `execFile`/`spawn` with `shell` option `true`
4178+
### DEP0190: Passing `args` to `node:child_process` `execFile`/`spawn` with `shell` option
41794179

41804180
<!-- YAML
41814181
changes:
@@ -4192,7 +4192,8 @@ changes:
41924192
Type: Runtime
41934193

41944194
When an `args` array is passed to [`child_process.execFile`][] or [`child_process.spawn`][] with the option
4195-
`{ shell: true }`, the values are not escaped, only space-separated, which can lead to shell injection.
4195+
`{ shell: true }` or `{ shell: '/path/to/shell' }`, the values are not escaped, only space-separated,
4196+
which can lead to shell injection.
41964197

41974198
### DEP0191: `repl.builtinModules`
41984199

0 commit comments

Comments
 (0)