Shescape

A simple shell escape library for JavaScript. Use it to escape user-controlled inputs to shell commands to prevent shell injection.

Quick links: npm | Source code | License | Changelog | Security

Features

• Advanced shell detection
• Lightweight
• Supports MacOS, Linux, and Windows
• Prevents environment variable access

Shells

The following shells are officially supported and extensively tested. It is recommended to only use shells found in this list.

• Unix: Bash, csh, Dash, Zsh
• Windows: cmd.exe, PowerShell

If you want to use Shescape with another shell you can request it on GitHub by opening an issue.

Usage

Install

1. Install shescape:

   npm install shescape

2. Import shescape:

   import { Shescape } from "shescape";

3. Initialize Shescape.

   const shescape = new Shescape(/* options */);

4. Use shescape.

Migrating from v1

View the migration guidelines for help.

Recipes

View the recipes for examples of how to use Shescape.

API

View the API documentation of Shescape.

Testing

View the testing documentation for how to test code that uses Shescape.

Further Reading

Read the tips for additional ways to protect against shell injection.

License

The source code is licensed under the MPL-2.0 license, see LICENSE for the full license text. The documentation text is licensed under CC BY-SA 4.0; code snippets under the MIT license.

Supporting code, such a scripts and tests, is generally licensed under the MIT license. However, individual files may be licensed differently depending on the intend or origin.

The license under which a given file is available can always be found in the file's banner comment.