Fix Command Injection in RedwoodJS

Command injection in RedwoodJS typically manifests in Services where user-supplied GraphQL arguments are passed to Node.js 'child_process' modules. If you're piping unsanitized strings into a shell environment, you're handing over a shell to anyone with an API client. Secure your backend by killing shell execution and enforcing strict input allowlists.

The Vulnerable Pattern

import { exec } from 'child_process';
// Redwood Service
export const archiveProject = ({ projectId }) => {
// CRITICAL VULNERABILITY: projectId is concatenated directly into a shell command.
// An attacker can pass: “123; rm -rf /”
exec(tar -czf archives/project-${projectId}.tar.gz projects/${projectId}, (error) => {
if (error) throw new Error(‘Archival failed’);
});
};

The Secure Implementation

The vulnerability exists because 'exec' invokes '/bin/sh' (or cmd.exe), which interprets shell metacharacters. By injecting a semicolon or pipe, an attacker can execute arbitrary system commands with the privileges of the Node.js process. The fix implements two layers of defense: first, 'Input Validation' using a strict regex to ensure only expected characters reach the logic. Second, 'Parameterization' by switching to 'execFile'. Unlike 'exec', 'execFile' passes arguments directly to the binary's process vector, bypassing shell evaluation entirely and neutralizing injection attempts.

import { execFile } from 'child_process';
export const archiveProject = ({ projectId }) => {
// 1. Validate input format (e.g., ensure it is a UUID or integer)
if (!/^[a-zA-Z0-9-]+$/.test(projectId)) {
throw new Error(‘Invalid Project ID’);
}
// 2. Use execFile instead of exec.
// execFile does not spawn a shell, so metacharacters like ’;’ or ’&’ are not interpreted.
const args = [‘-czf’, archives/project-${projectId}.tar.gz, projects/${projectId}];
execFile(‘tar’, args, (error) => {
if (error) throw new Error(‘Archival failed’);
});
};