Process Spawn

Secret-safe child_process.spawn wrapper — argv allowlist via the operator's caller, no shell:true reliance, env scrubbing of connection strings and credential variables, and output redaction in the audit metadata (env-var NAMES are recorded, never values).

Operators reaching for child_process.spawn directly inherit process.env by default — which means a child (jq, the postgres CLI, an unzipper) sees DATABASE_URL, PG*, REDIS_URL, S3_*, AWS_*. OWASP-1 closes that class: every spawn through b.processSpawn uses a filtered env by default; operators opt in to specific secret env vars via opts.allowEnv when the child genuinely needs them.

Filter patterns (case-insensitive — matches Windows env-var capitalization too): DATABASE_URL, PG*, POSTGRES*, MYSQL*, REDIS_URL, MONGO*, AWS_(ACCESS_KEY_ID|SECRET_ACCESS_KEY| SESSION_TOKEN), S3_*, AZURE_*, GCP_*, GOOGLE_APPLICATION_CREDENTIALS, suffixes *_TOKEN, *_SECRET, *_PASSWORD, *_API_KEY, *_PRIVATE_KEY, *_PASSPHRASE. The frozen pattern list is exposed as b.processSpawn.FILTER_PATTERNS for operator inspection.

Audit: process.spawn (success) — metadata carries command, arg count, and the redacted list of env-var names that were stripped.

b.processSpawn.filteredEnv(source, allowEnv) #

Pure helper that returns { env, filtered } — env is source with every variable matching FILTER_PATTERNS removed, except for names listed in allowEnv (explicit pass-through). filtered is the array of stripped variable names; values are never returned or logged.

source defaults to process.env when omitted. Useful for pre-flight inspection (which secrets would the spawn drop?) without actually launching a child.

var report = b.processSpawn.filteredEnv({
  PATH:                 "/usr/bin",
  AWS_ACCESS_KEY_ID:    "AKIA...",
  AWS_SECRET_ACCESS_KEY: "wJalr...",
  AWS_REGION:           "us-east-1",
  DATABASE_URL:         "postgres://...",
}, ["AWS_REGION"]);
report.env.PATH;       // → "/usr/bin"
report.env.AWS_REGION; // → "us-east-1"
report.env.DATABASE_URL;       // → undefined
report.filtered.indexOf("AWS_ACCESS_KEY_ID") !== -1; // → true
report.filtered.indexOf("DATABASE_URL")      !== -1; // → true

b.processSpawn.spawn(command, args, opts) #

{
  stdio:    string | Array,                  // forwarded to child_process.spawn
  cwd:      string,                          // forwarded to child_process.spawn
  detached: boolean,                         // forwarded to child_process.spawn
  env:      object,                          // explicit override; bypasses filter
  allowEnv: string[],                        // pass-through whitelist applied to process.env
  ...                                        // every other Node spawn opt is forwarded
}

Spawn a child process with the connection-string filter applied to process.env before exec. Returns the underlying child_process.ChildProcess so operators can attach the usual stdout / stderr / close listeners. Emits one process.spawn audit row carrying the command, arg count, and the names (never values) of the env vars that were stripped.

Throws ProcessSpawnError("process-spawn/bad-command") when command is not a non-empty string. opts.env, when supplied, is trusted verbatim — operators that pass an explicit env take full responsibility for what reaches the child.

var child = b.processSpawn.spawn(process.execPath, ["-e", "process.exit(0)"], {
  stdio:    "ignore",
  allowEnv: ["AWS_REGION"],
});
typeof child.pid; // → "number"
child.kill();

Last updated 2026-08-08T16:39:49.652Z by seeder.