shescape

Shescape

A simple shell escape package for JavaScript. Use it to escape user-controlled inputs to shell commands to prevent shell injection.

Example

Please read the full documentation for more information.

Below is a basic example of how to use Shescape. In this example execSync is used to invoke a shell command and shescape.quote is used to quote and escape any dangerous character in the user input used as command input.

import { execSync } from "child_process";
import * as shescape from "shescape";

const userInput = "&& ls";
const stdout = execSync(`echo Hello ${shescape.quote(userInput)}`);
console.log(stdout.toString());
// Output:  "Hello && ls"