Shescape

A simple shell escape library for JavaScript. Use it to escape user-controlled inputs to shell commands to prevent shell injection.

Quick links: npm | Source code | License | Changelog | Security

Features

Advanced shell detection
Lightweight
Supports MacOS, Linux, and Windows
Prevents environment variable access

Shells

The following shells are officially supported and extensively tested. It is recommended to only use shells found in this list.

Unix: Bash, csh, Dash, Zsh
Windows: cmd.exe, PowerShell

If you want to use Shescape with another shell you can request it on GitHub by opening an issue.

Usage

Install

Install shescape:
```
npm install shescape
```
Import shescape:
```
import { Shescape } from "shescape";
```

Initialize Shescape.

const shescape = new Shescape(/* options */);

Use shescape.

Migrating from v1

View the migration guidelines for help.

Recipes

View the recipes for examples of how to use Shescape.

API

View the API documentation of Shescape.

Testing

View the testing documentation for how to test code that uses Shescape.

License

The source code is licensed under the MPL-2.0 license, see LICENSE for the full license text. The documentation text is licensed under CC BY-SA 4.0; code snippets under the MIT license.

Supporting code, such a scripts and tests, is generally licensed under the MIT license. However, individual files may be licensed differently depending on the intend or origin.

The license under which a given file is available can always be found in the file's banner comment.

Current Tags

2.1.0 ... latest (a year ago)
2.0.0-rc3 ... next (a year ago)