Apa cara kanggo menjalankan proses eksternal nganggo child_process?

Question

Accepted Answer

Module **`child_process`** ngidini Node kanggo menjalankan **program/perintah liyane** (perintah shell, skrip, binari liyane) minangka proses OS sing kapisah. Diperlukake kanggo nglibatake piranti sistem, menjalankan karya CPU-heavy ana jaba proses utama, utawa ngatur program liyane.

## Empat metode utama

```text
exec      → run a shell command, buffer all output (simple, small output)
execFile  → run a file directly (no shell — safer, faster)
spawn     → stream output (for large output / long-running processes)
fork      → spawn a new NODE process with an IPC channel (Node-to-Node)
```

## exec — sederhana, dibuffer

```js
import { exec } from "child_process";

exec("ls -la", (err, stdout, stderr) => {
  if (err) return console.error(err);
  console.log(stdout); // the entire output, buffered into memory
});
```

`exec` mudah kanggo perintah cendhak nanging ngumpulake kabeh output — baya kanggo perintah sing ngasilake output gedhe (bisa lumampas watas buffer).

## spawn — streaming (kanggo output gedhe/terusan)

```js
import { spawn } from "child_process";

`spawn` ngalirake output nalika diproduksi (memori konstan) lan njupuk argument minangka **array** (dudu string shell) — pilihan sing bener kanggo proses jangka panjang utawa output dhuwur.

## Pepeling keamanan: penyuntikan perintah

```js
// ❌ DANGEROUS — user input in a shell command enables injection
exec(`convert ${userFilename} out.png`); // userFilename = "; rm -rf /" → disaster

// ✅ use execFile/spawn with an args array — no shell interpolation
execFile("convert", [userFilename, "out.png"]); // args passed safely, not parsed by a shell
```

Jangan pernah ngetik input sing ora dipercaya menyang string shell `exec` — mula kesurupan **penyuntikan perintah**. Gunak `execFile`/`spawn` nganggo array argument dadi input diliwatake minangka data, dudu sintaks shell.

## Panggunaan basis Promise

```js
import { promisify } from "util";
const execAsync = promisify(exec);
const { stdout } = await execAsync("git rev-parse HEAD");
```

## Mengapa iki penting

`child_process` ngidini Node ngrembaka karo sistem luwih dangu — menjalankan alat CLI (git, ffmpeg, imagemagick), ngasingake tugas CPU-heavy menyang proses kapisah (nglindungi blocking event loop), lan ngatur program liyane.

Ngerti cara kanggo milih metode (`spawn` kanggo streaming/output gedhe, `exec` kanggo perintah sederhana, `fork` kanggo subproses Node) lan — nang prayoga — **risiko penyuntikan perintah** saka `exec` karo input pengguna (dikurangi dening `execFile`/`spawn` karo array arg) dadi perlu kanggo kagunaan efektif lan aman.