Skip to content

Commit 7df18dd

Browse files
committed
doc: clarify that any truthy value of shell is part of DEP0190
1 parent 8ccbe8e commit 7df18dd

File tree

1 file changed

+3
-2
lines changed

1 file changed

+3
-2
lines changed

doc/api/deprecations.md

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4175,7 +4175,7 @@ Type: Documentation-only
41754175
`process.features.tls_alpn`, `process.features.tls_ocsp`, and `process.features.tls_sni` are
41764176
deprecated, as their values are guaranteed to be identical to that of `process.features.tls`.
41774177

4178-
### DEP0190: Passing `args` to `node:child_process` `execFile`/`spawn` with `shell` option `true`
4178+
### DEP0190: Passing `args` to `node:child_process` `execFile`/`spawn` with `shell` option
41794179

41804180
<!-- YAML
41814181
changes:
@@ -4192,7 +4192,8 @@ changes:
41924192
Type: Runtime
41934193

41944194
When an `args` array is passed to [`child_process.execFile`][] or [`child_process.spawn`][] with the option
4195-
`{ shell: true }`, the values are not escaped, only space-separated, which can lead to shell injection.
4195+
`{ shell: true }` or `{ shell: '/bin/zsh' }`, the values are not escaped, only space-separated,
4196+
which can lead to shell injection.
41964197

41974198
### DEP0191: `repl.builtinModules`
41984199

0 commit comments

Comments
 (0)