Hi I am pretty new to web security and am worried about possible shell/command injection risks. I am wondering if it is safe to run a command line script only in my nodejs backend and have the web host run it.
From my understanding, it would be safe to run as the backend is not able to be accessed from the website and its front end.
From my understanding, it would be safe to run as the backend is not able to be accessed from the website and its front end.
That is essentially correct, but I would rephrase it to:
It is safe to run a shell script from your web server as long as the parameters you are passing to the shell script are either hard-coded or server-generated values.
Shell-injection happens when you take strings that came from the web user, and pass them as parameters to the exec call. It is possible to do that safely, but you'll need to carefully sanitize or escape the input to make it command-line safe, but this is a bit tricky and hard to do correctly since the list of "dangerous characters" that you need to sanitize / escape is different in bash vs zsh vs powershell, etc.
