Skip to content

Commit f976c92

Browse files
committed
doc: clarify that any truthy value of shell is part of DEP0190
PR-URL: #62249 Reviewed-By: René <contact.9a5d6388@renegade334.me.uk> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
1 parent 531c64d commit f976c92

File tree

1 file changed

+3
-2
lines changed

1 file changed

+3
-2
lines changed

doc/api/deprecations.md

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4164,7 +4164,7 @@ Type: Documentation-only
41644164
`process.features.tls_alpn`, `process.features.tls_ocsp`, and `process.features.tls_sni` are
41654165
deprecated, as their values are guaranteed to be identical to that of `process.features.tls`.
41664166

4167-
### DEP0190: Passing `args` to `node:child_process` `execFile`/`spawn` with `shell` option `true`
4167+
### DEP0190: Passing `args` to `node:child_process` `execFile`/`spawn` with `shell` option
41684168

41694169
<!-- YAML
41704170
changes:
@@ -4181,7 +4181,8 @@ changes:
41814181
Type: Runtime
41824182

41834183
When an `args` array is passed to [`child_process.execFile`][] or [`child_process.spawn`][] with the option
4184-
`{ shell: true }`, the values are not escaped, only space-separated, which can lead to shell injection.
4184+
`{ shell: true }` or `{ shell: '/path/to/shell' }`, the values are not escaped, only space-separated,
4185+
which can lead to shell injection.
41854186

41864187
### DEP0191: `repl.builtinModules`
41874188

0 commit comments

Comments
 (0)