Running command from Node.js with sudo
<p>Being new to Node.js, I have this question..</p>

<p>I see it mentioned in a few places that node should not be run as root, such as <a href="http://syskall.com/dont-run-node-dot-js-as-root/" rel="nofollow">this</a>. I am just using node to set up a <strong>simple</strong> web service and executing a python script which requires root access. I just don't understand where the danger lies, as in what <strong>could</strong> the hacker do.</p>

<p>My node.js file is something like this:-</p>

<pre><code>var http = require('http');
var express = require('express');

var app = express();


app.use(express['static'](__dirname));


app.get('/alert', function(req, res) {
    var addr = req.query.addr;
    //~ need to check if it is a valid address??
    console.log('Received addr -' + addr);

    var spawn = require('child_process').spawn;

    var process = spawn('python', ['custom-text-led/custom-text.py', addr]);

    process.stdout.on('data', function(data) {
        console.log('Data:' + data);
    });


})

app.get('*', function(req, res) {
    res.status(404).send('Unrecognized API call');
});

app.use(function(err, req, res, next) {
    if (req.xhr) {
        res.status(500).send('Opps, something went wrong');
    } else {
        next(err);
    }
});

app.listen(3000);

console.log('App server running at port 3000');
</code></pre>

<p>The hacker could do anything if there is any security issues.
You could give the user witch runs the web server the permission to do the task your task is intending to do.</p>

<p>In general try to avoid root whenever you can (put the tinfoil hat on).</p>

javascript python node.js express child-process