codeql/javascript/ql/src/Security/CWE-078/examples/shell-command-injection-from-environment_fixed.js

var cp = require("child_process"),
  path = require("path");
function cleanupTemp() {
  let cmd = "rm",
    args = ["-rf", path.join(__dirname, "temp")];
  cp.execFileSync(cmd, args); // GOOD
}