child_process: improve ChildProcess validation

This commit improves input validation for the ChildProcess
internals. It became officially supported API a while back, but
never had any validation.

Refs: https://github.com/nodejs/node/issues/12177
PR-URL: https://github.com/nodejs/node/pull/12348
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Santiago Gimeno <santiago.gimeno@gmail.com>

1 files changed, 19 insertions, 3 deletions

diff --git a/lib/internal/child_process.js b/lib/internal/child_process.js
index c80b0130be..e411a4661d 100644
--- a/lib/internal/child_process.js
+++ b/lib/internal/child_process.js
@@ -254,6 +254,9 @@ ChildProcess.prototype.spawn = function(options) {
   var ipcFd;
   var i;
 
+  if (options === null || typeof options !== 'object')
+    throw new TypeError('"options" must be an object');
+
   // If no `stdio` option was given - use default
   var stdio = options.stdio || 'pipe';
 
@@ -265,12 +268,25 @@ ChildProcess.prototype.spawn = function(options) {
 
   if (ipc !== undefined) {
     // Let child process know about opened IPC channel
-    options.envPairs = options.envPairs || [];
+    if (options.envPairs === undefined)
+      options.envPairs = [];
+    else if (!Array.isArray(options.envPairs))
+      throw new TypeError('"envPairs" must be an array');
+
     options.envPairs.push('NODE_CHANNEL_FD=' + ipcFd);
   }
 
-  this.spawnfile = options.file;
-  this.spawnargs = options.args;
+  if (typeof options.file === 'string')
+    this.spawnfile = options.file;
+  else
+    throw new TypeError('"file" must be a string');
+
+  if (Array.isArray(options.args))
+    this.spawnargs = options.args;
+  else if (options.args === undefined)
+    this.spawnargs = [];
+  else
+    throw new TypeError('"args" must be an array');
 
   var err = this._handle.spawn(options);