harden: sanitize child_process call in ssl-min-allow-tls-test.js

README.md

@@ -19,7 +19,7 @@ The Progress® MarkLogic® Node Client API provides access to the MarkLogic data
 
 ## System Requirements
 
-The Node Client 4.1.0 release requires Node.js 22 or higher. Testing has verified that the client will
+The Node Client 4.2.0 release requires Node.js 22 or higher. Testing has verified that the client will
 run successfully on Node 20, but we recommend 22 or higher based on
 [the Node.js release roadmap](https://nodejs.org/en/about/previous-releases), as Node 20 enters
 end-of-life in April 2026 while Node 22 is supported through April 2027.

package.json

@@ -3,7 +3,7 @@
   "name": "marklogic",
   "description": "The official MarkLogic Node.js client API.",
   "homepage": "https://github.com/marklogic/node-client-api",
-  "version": "4.1.0",
+  "version": "4.2.0",
   "license": "Apache-2.0",
   "main": "./lib/marklogic.js",
   "types": "marklogic.d.ts",

test-basic/ssl-min-allow-tls-test.js

@@ -5,7 +5,7 @@
 let testconfig = require('../etc/test-config.js');
 let should = require('should');
 let marklogic = require('../');
-const { exec } = require('child_process');
+const { execFile } = require('child_process');
 const testlib = require("../etc/test-lib");
 let db = marklogic.createDatabaseClient(testconfig.restConnectionForTls);
 let serverConfiguration = {};
@@ -141,12 +141,13 @@ describe('document write and read using min tls', function () {
 
 function updateTlsVersion(tlsVersion) {
     return new Promise((resolve, reject) => {
-        const curlCommand = `
-            curl --anyauth --user admin:admin -X PUT -H "Content-Type: application/json" \
--d '{"ssl-min-allow-tls": "${tlsVersion}"}' \
-'http://${host}:8002/manage/v2/servers/unittest-nodeapi-ssl/properties?group-id=Default'
-    `;
-        exec(curlCommand, (error, stdout, stderr) => {
+        const curlArgs = [
+            '--anyauth', '--user', 'admin:admin', '-X', 'PUT',
+            '-H', 'Content-Type: application/json',
+            '-d', JSON.stringify({'ssl-min-allow-tls': tlsVersion}),
+            `http://${host}:8002/manage/v2/servers/unittest-nodeapi-ssl/properties?group-id=Default`
+        ];
+        execFile('curl', curlArgs, (error, stdout, stderr) => {
             if (error) {
                 throw new Error(`Error executing curl: ${stderr}`);
             }