Web Security · Middle · Question 65 of 75

Which Node.js call is most dangerous with user input?

1execFile('convert', [fileName, 'out.png'])
✓Correct answer: exec('convert ' + fileName + ' out.png')
3fs.readFile(safePath) with a validated path

Explanation

exec passes the string to a shell, so ; rm -rf / in the name becomes a command. execFile with an argument array avoids the shell.

Further reading

Test yourself

Take the Web Security · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.