SH008: Dynamic code execution

Severity: high · Category: security · Applies to: node

Why it matters

eval, new Function and shell commands built from strings run attacker-controlled input as code when any part of the string comes from a user.

How to fix

Avoid eval. Use execFile/spawn with an argument array instead of building a shell string.

Ignoring this rule

Skip it everywhere in devshield.yml:

ignore:
  - SH008

Or skip one line with a comment on that line or the line above:

devshield-ignore: SH008