Proposed quick fixes to (node:60880) [DEP0190] DeprecationWarning: Don't work

[adligo]

Node.js Version

v24.2.0

NPM Version

11.4.2

Operating System

Windows 11

Subsystem

child_process

Description

After encountering this error;

 (node:60880) [DEP0190] DeprecationWarning: Passing args to a child process with shell option true can lead to security vulnerabilities, as the arguments are not escaped, only concatenated.

The proposed quick fix of string concatenation of the command with its arguments will not work from this thread;
11.4.2

See how the following simple code sinippit returns zero for ssr's status and null for ssr2's status.

import {Buffer} from 'buffer';
import * as fs from 'fs';
import {spawnSync} from 'child_process';

let ssr = spawnSync('ls', ['-Al']);
console.log("ls -Al has a return / statusCode / status of " + ssr.status)

let ssr2 = spawnSync('ls -Al', []);
console.log("ls -Al has a return / statusCode / status of " + ssr2.status)

Minimal Reproduction

No response

Output

No response

Before You Submit

• I have looked for issues that already exist before submitting this
• My issue follows the guidelines in the README file, and follows the 'How to ask a good question' guide at https://stackoverflow.com/help/how-to-ask

[adligo]

Also note: The code in the snippet is in a .mjs file.

[avivkeller]

IIUC, you are saying that a given solution to another issue didn't work for you.

Instead of opening a new issue, you should comment on the original.

[adligo]

I disagree; the bug is that the status code is null, when it should be zero. It is related to the other issue, but it is a distinct issue separate from the depreciation issue. You should fix your buggy code!

[avivkeller]

You should fix your buggy code!

First, I'm genuinely trying to help you, so I'd appreciate a more respectful tone.

Secondly, your issue title was "Proposed quick fixes [...] don't work", and you opened your issue with "the proposed quick fix of string concatenation of the command with its arguments will not work from this thread". So, I am correct in my understanding that you are referring to a given solution not working.

Furthermore, if you would've formatted this report in such a way where it would have been clearly not a duplicate, it would have been closed as invalid. .status returning null is valid, please refer to our documentation before opening bug reports.

[avivkeller]

when it should be zero

By reading our documentation, available at https://nodejs.org/api/child_process.html, you would know that, when shell: false, the first argument to spawnSync is the path to the command to execute. "$PATH/ls -Al" is not a valid command path.

[adligo]

Ok, so I should open another issue to make you happy?

[adligo]

Also, I'm not sure if I follow what you're saying here. I think both of my examples in the code provided would execute the same, so since they both do not have a valid command path, why would one have a status of zero and another have a status of null?

when it should be zero

By reading our documentation, available at https://nodejs.org/api/child_process.html, you would know that, when shell: false, the first argument to spawnSync is the path to the command to execute. "$PATH/ls -Al" is not a valid command path.

[avivkeller]

No, your first call is valid, since ls is valid. Exit status 0 means the command succeeded.

[avivkeller]

Ok, so I should open another issue to make you happy?

No, it's okay right now, but, in the future, it's easier to distinguish issues when they are clearly separate, rather than intertwined

[adligo]

Ok, thanks for your help! I must be seeing/trying to identify another issue. I do see that I get zero from both printouts of this code. I thought the following was the same as the earlier code, however, it's different;

import {Buffer} from 'buffer';
import * as fs from 'fs';
import {spawnSync} from 'child_process';

console.log(process.env.SHELL); 
let options = {shell: process.env.SHELL};

let ssr = spawnSync('ls', ['-Al'], options);
console.log("ls -Al has a return / statusCode / status of " + ssr.status)
console.log(ssr.output);

let ssr2 = spawnSync('ls -Al', [], options);
console.log("ls -Al has a return / statusCode / status of " + ssr2.status)
console.log(ssr2.output);