Exec function calls JSON.stringify on command

[beefancohen]

Node version (or tell us if you're using electron or some other framework):

v6.10.2

ShellJS version (the most recent version/Github branch you see the bug on):

0.7.8

Operating system:

Mac osx

Description of the bug:

Exec function calls JSON.stringify on the command. This causes issues when trying to pass 64 bit unsigned long strings as arguments since JSON.stringify cannot natively handle them. They get truncated and data is lost.

Is JSON.stringify necessary or can we add a flag to avoid parsing like that?

exec('foo --id 909845429478596609')

[freitagbr]

I think your problem may not be with JSON.stringify. In the case of exec, it's used to address escaping issues and code-injection when the temporary JS file is written. In your example:

exec('foo --id 909845429478596609')

ends up in the temporary JS file as:

var childProcess = child.exec("foo --id 909845429478596609", {}, function(err) {
    // ...
});

In other words, the individual parts of the command are not stringified, the whole command is. To illustrate how this prevents escaping and code-injection issues, take for example this command:

exec('echo"); console.log("vulnerable"); console.log("')

which ends up as:

var childProcess = child.exec("echo\"); console.log(\"vulnerable\"); console.log(\"", {}, function(err) {
    // ...
});

Without JSON.stringify, it might end up like this:

var childProcess = child.exec("echo"); console.log("vulnerable"); console.log("", {}, function(err) {
    // ...
});

Anyways, this was a long way of saying that the issue is probably with how foo is handling command-line arguments.

[nfischer]

@evcohen what happens if you try child_process.execSync('foo --id 909845429478596609')? Success or failure?

[nfischer]

We'll remove most uses of JSON.stringify() as part of #782. Therefore, closing this.

I suspect @freitagbr is right, the issue with foo is that it doesn't handle CLI arguments correctly.