Shescape

A simple shell escape library for JavaScript. Use it to escape user-controlled inputs to shell commands to prevent shell injection.

Quick links: npm | Source code | License | Changelog | Security

Features

Advanced shell detection
Lightweight
Supports MacOS, Linux, and Windows
Prevents environment variable access

Shells

The following shells are officially supported and extensively tested. It is recommended to only use shells found in this list.

Unix: Bash, BusyBox, csh, Dash, Zsh
Windows: cmd.exe, PowerShell

If you want to use Shescape with another shell you can request it on GitHub by opening an issue.

Usage

Install

Install shescape:
```
npm install shescape
```
Import shescape:
```
import { Shescape } from "shescape";
```

Initialize Shescape.

const shescape = new Shescape(/* Options */);

Use shescape.

Getting Started

Look at the use cases for Shescape.
Check the recipes for examples of how to use Shescape.
Read the tips for additional ways to protect against shell injection.
Having trouble? See the troubleshooting document for help.

Migrating from v1

View the migration guidelines for help.

API

View the API documentation of Shescape.

Testing

View the testing documentation for how to test code that uses Shescape.

License

The source code is licensed under the MPL-2.0 license, see LICENSE for the full license text. The documentation text is licensed under CC BY-SA 4.0; code snippets under the MIT-0 license.

Supporting code (scripts and tests) is generally licensed under the MIT or MIT-0 license. Individual files may be licensed differently depending on the intent or origin.

The license under which a given file is available can always be found in the file's banner comment.

Current Tags

2.1.11 ... latest (3 days ago)
2.0.0-rc3 ... next (3 years ago)