child_process: improve ChildProcess validation

This commit improves input validation for the ChildProcess internals. It became officially supported API a while back, but never had any validation. Refs: #12177 PR-URL: #12348 Reviewed-By: James M Snell <[email protected]> Reviewed-By: Santiago Gimeno <[email protected]>

Author: cjihrig

lib/internal/child_process.js

@@ -254,6 +254,9 @@ ChildProcess.prototype.spawn = function(options){
 varipcFd;
 vari;
 
+if(options===null||typeofoptions!=='object')
+thrownewTypeError('"options" must be an object');
+
 // If no `stdio` option was given - use default
 varstdio=options.stdio||'pipe';
 
@@ -265,12 +268,25 @@ ChildProcess.prototype.spawn = function(options){
 
 if(ipc!==undefined){
 // Let child process know about opened IPC channel
-options.envPairs=options.envPairs||[];
+if(options.envPairs===undefined)
+options.envPairs=[];
+elseif(!Array.isArray(options.envPairs))
+thrownewTypeError('"envPairs" must be an array');
+
 options.envPairs.push('NODE_CHANNEL_FD='+ipcFd);
 }
 
-this.spawnfile=options.file;
-this.spawnargs=options.args;
+if(typeofoptions.file==='string')
+this.spawnfile=options.file;
+else
+thrownewTypeError('"file" must be a string');
+
+if(Array.isArray(options.args))
+this.spawnargs=options.args;
+elseif(options.args===undefined)
+this.spawnargs=[];
+else
+thrownewTypeError('"args" must be an array');
 
 varerr=this._handle.spawn(options);
 

test/parallel/test-child-process-constructor.js

@@ -5,6 +5,50 @@ const assert = require('assert');
 const{ ChildProcess }=require('child_process');
 assert.strictEqual(typeofChildProcess,'function');
 
+{
+// Verify that invalid options to spawn() throw.
+constchild=newChildProcess();
+
+[undefined,null,'foo',0,1,NaN,true,false].forEach((options)=>{
+assert.throws(()=>{
+child.spawn(options);
+},/^TypeError:"options"mustbeanobject$/);
+});
+}
+
+{
+// Verify that spawn throws if file is not a string.
+constchild=newChildProcess();
+
+[undefined,null,0,1,NaN,true,false,{}].forEach((file)=>{
+assert.throws(()=>{
+child.spawn({ file });
+},/^TypeError:"file"mustbeastring$/);
+});
+}
+
+{
+// Verify that spawn throws if envPairs is not an array or undefined.
+constchild=newChildProcess();
+
+[null,0,1,NaN,true,false,{},'foo'].forEach((envPairs)=>{
+assert.throws(()=>{
+child.spawn({ envPairs,stdio: ['ignore','ignore','ignore','ipc']});
+},/^TypeError:"envPairs"mustbeanarray$/);
+});
+}
+
+{
+// Verify that spawn throws if args is not an array or undefined.
+constchild=newChildProcess();
+
+[null,0,1,NaN,true,false,{},'foo'].forEach((args)=>{
+assert.throws(()=>{
+child.spawn({file: 'foo', args });
+},/^TypeError:"args"mustbeanarray$/);
+});
+}
+
 // test that we can call spawn
 constchild=newChildProcess();
 child.spawn({