I need to list all the files in the JavaScript thingy, such as using "ls".
-
3You are talking about executing commands server-side, correct? Not on the client browser?Ehtesh Choudhury– Ehtesh Choudhury2012-10-06 19:58:40 +00:00Commented Oct 6, 2012 at 19:58
Add a comment
|
6 Answers
Unprivileged JavaScript in a browser can neither list files nor execute programs for security reasons.
In Node.js, for example, executing programs works like this:
var spawn = require('child_process').spawn,
var ls = spawn('ls', ['-l']);
ls.stdout.on('data', function (data) {
console.log(data);
});
And there is a direct way to list files using readdir().
answered Mar 16, 2011 at 6:59
Hendrik Brummermann
8,3403 gold badges34 silver badges55 bronze badges
1 Comment
Maf
I suppose this is going to run on a server. What about pure JavaScript to run on the client? Just for security testing.
An even easier way in node.js is:
var fs = require('fs');
var ls = fs.readdirSync('/usr');
The variable ls now contains an array with the filenames at /usr.
Comments
The short answer is: you should not do this as it opens a huge attack vector against your application. Imagine someone running "rm -rf" :).
If you must do this and you are 1000% sure you allow only a few commands which cannot cause any harm you can call a server page using Ajax. That page could run the specified command and return response. Again I emphasize this is a huge security risk and should better not be done.
1 Comment
gunslingor
Related conversation: stackoverflow.com/questions/41088671/…
AFAIK, you can not run any system command. This will violate the security model. You can do send a print command, but I wonder anything beyond that is possible.
1 Comment
Maf
Is that an heresy to say that if someone can access the stdout then somehow other system calls also could be invoked after passing some security barrier?
If you'd like the program you run give out output that uses ANSI escape sequences (for example, to print out the progress percentage on the screen):
I wasn't able to do that on macOS unless I use the following (I am using macOS v13 (Ventura)):
const { spawn } = require("node:child_process");
const commandProcess = spawn(
"node",
["someScript.js", "someArg1", "someArg2"],
{
stdio: "inherit"
}
);
This will show all the standard output, standard error, etc., on screen, as if it is a command typed into a shell. This is the documentation.
