Yaya kake guduwa abubuwan waje tare da child_process?

Question

Accepted Answer

Module **`child_process`** yana ba da dama Node ya guduwa **wasu shirye-shirye/umarni" (umarni na bakin kasko, rubutu, wasu binaries) azaman jiyya OS na daban-daban. Sauƙi don kira abubuwan kayan sira, guduwa aiki masu nauyi na CPU wajen tsayar da girgiza, ko shiryayar wasu shirye-shirye.

## Hanyoyin mafi mahimmanci hudu

```text
exec      → run a shell command, buffer all output (simple, small output)
execFile  → run a file directly (no shell — safer, faster)
spawn     → stream output (for large output / long-running processes)
fork      → spawn a new NODE process with an IPC channel (Node-to-Node)
```

## exec — sauƙi, buffered

```js
import { exec } from "child_process";

exec("ls -la", (err, stdout, stderr) => {
  if (err) return console.error(err);
  console.log(stdout); // the entire output, buffered into memory
});
```

`exec` sauƙi ne don gajere umarni kuma buffers duk abun da ya fitu — hadari ne don umarni da ke haifar da girman abun da ya fitu (zai iya wuce iyakar buffer).

## spawn — maimakon (domin girman/cikin jiya abun da ya fitu)

```js
import { spawn } from "child_process";

`spawn` yana maimakon abun da ya fitu yayin da aka haifa shi (ajiya na akai-akai) kuma yana ɗauki arguments azaman **array** (ba shi string bakin kasko) — zaɓin daidai don aiki masu dogon lokaci ko matakin abun da ya fitu.

## Gargadi na tsaro: injection umarni

```js
// ❌ DANGEROUS — user input in a shell command enables injection
exec(`convert ${userFilename} out.png`); // userFilename = "; rm -rf /" → disaster

// ✅ use execFile/spawn with an args array — no shell interpolation
execFile("convert", [userFilename, "out.png"]); // args passed safely, not parsed by a shell
```

Kadai sake saka bayani mara aminci a cikin jerin kasko na `exec` — yana ba da damar **command injection**. Yi amfani da `execFile`/`spawn` tare da jerin arguments saɓi bayani za a ɗauke azaman data, ba shi syntax bakin kasko.

## Amfani mai tushe ga Promise

```js
import { promisify } from "util";
const execAsync = promisify(exec);
const { stdout } = await execAsync("git rev-parse HEAD");
```

## Me yasa yana da mahimmanci

`child_process` yana ba da dama Node ta hade da tsarin wider — gudu CLI tools (git, ffmpeg, imagemagick), toshe aiki masu nauyi na CPU zuwa jiyya daban-daban (guje ɗing shaɓa event loop), da shiryaya wasu shirye-shirye.

Sanin wace hanya za a yi amfani ta (`spawn` domin maimakon/girman abun da ya fitu, `exec` domin gajere umarni, `fork` domin Node subprocesses) da — takamait — **hadari na command-injection** na `exec` tare da bayani masu amfani (raguwa ta `execFile`/`spawn` tare da jerin arg) yana da dama ga amfani da shi da kyau da tsaro.