Fix Command Injection in Meteor

Meteor's Node.js backend environment is frequently compromised when developers treat user input as trusted shell arguments. Using `child_process.exec` with unsanitized strings allows attackers to break out of the intended command context using shell metacharacters like `;`, `&`, or `|`. To secure Meteor methods, you must transition from shell-based execution to direct process spawning with argument arrays.

The Vulnerable Pattern

import { exec } from 'child_process';
Meteor.methods({
‘analyzeHost’(hostAddress) {
// CRITICAL VULNERABILITY: User input is concatenated directly into a shell command.
// An attacker could pass: ‘8.8.8.8; rm -rf /’
exec(nslookup ${hostAddress}, (err, stdout, stderr) => {
if (err) throw new Meteor.Error(‘exec-failed’, err.message);
console.log(stdout);
});
}
});

The Secure Implementation

The vulnerability exists because `child_process.exec` spawns a full shell environment to parse the command string. By switching to `execFile` or `spawn`, you bypass the shell entirely. In the secure version, the `hostAddress` is passed in an array, ensuring the OS treats it strictly as a parameter to the `nslookup` binary rather than part of a command sequence. This effectively neutralizes shell injection vectors.

import { execFile } from 'child_process';
Meteor.methods({
‘analyzeHost’(hostAddress) {
// SECURE: execFile does not spawn a shell. Input is passed as a literal argument.
// Even if hostAddress contains shell metacharacters, they are treated as literal text.
execFile(‘nslookup’, [hostAddress], (err, stdout, stderr) => {
if (err) throw new Meteor.Error(‘exec-failed’, err.message);
console.log(stdout);
});
}
});