Node.js • Chapter 45 • Beginner Friendly
Child Processes
Learn this chapter by understanding what each Node.js feature does, when to use it, how it can fail, and how to verify the result.
45.1 spawn vs exec
spawn vs exec is part of Chapter 45, “Child Processes.” For a beginner, the first goal is to understand the observable behavior before memorizing an API. In this lesson, concurrency means making progress on more than one task through processes, threads, or network I/O. The practical focus is inputs, observable output, error behavior, and the resource that the operation consumes.
Start from the smallest working behavior and name every input and output. In Chapter 45 (Child Processes), for spawn vs exec, write down what enters the operation, what Node.js is expected to do, and what the caller can observe afterward. If the result is asynchronous, also state when completion is known and where errors travel.
For spawn vs exec in Chapter 45, the mechanism to keep in mind is measuring resource cost and choosing isolation appropriate to the workload. A good experiment changes one thing at a time and checks both success and failure. When you finish this topic, you should be able to explain why the code works, not only copy the syntax.
Key terms in plain language
- concurrency — making progress on more than one task through processes, threads, or network I/O.
- spawn — a concrete part of spawn vs exec that the lesson isolates so you can see its effect instead of treating the whole feature as a black box.
- exec — a concrete part of spawn vs exec that the lesson isolates so you can see its effect instead of treating the whole feature as a black box.
10 teaching examples
Example 1: Performance check
While studying Child Processes, measure the resource most affected by spawn vs exec: elapsed time, bytes, memory, open connections, event-loop delay, or database round trips. Optimize only after the measurement identifies a meaningful cost.
Example 2: Refactoring example
In a Child Processes exercise, take code that mixes spawn vs exec with unrelated business logic and split it into a small function with an explicit input and return value. The caller should not need to know low-level details unless they are part of the contract.
Example 3: Production reasoning
Assume the spawn vs exec code from Chapter 45 runs thousands of times. Decide what needs a timeout, limit, retry rule, cleanup step, metric, or graceful-shutdown hook. The goal is predictable behavior under repetition, load, and partial failure.
Example 4: Minimal working case
In Chapter 45 (Child Processes), build the smallest spawn vs exec example that has one clear input and one visible result. Before running it, write what you expect to happen. Then verify inputs, observable output, error behavior, and the resource that the operation consumes. This establishes a baseline you can reason about.
Example 5: Change one input
For Chapter 45 (Child Processes), keep the same program but change exactly one input related to spawn vs exec. Compare the two outputs and explain why the change happened. This teaches cause and effect instead of memorizing syntax.
Example 6: Compare two approaches
Within Child Processes, solve one tiny task twice: first with the most direct approach to spawn vs exec, then with a reasonable alternative. Compare readability, error behavior, and resource use. Choose the version whose tradeoff matches the task.
Example 7: Failure you can recognize
For Child Processes, create a safe failure involving spawn vs exec, such as invalid data, a missing resource, a closed connection, or a rejected promise. Observe the error type and decide where the program should handle it rather than hiding it.
Example 8: Real service scenario
Imagine a small tutoring-service backend applying spawn vs exec during Chapter 45 (Child Processes). State what arrives from the caller, what the Node.js process must do, what it returns, and what must be logged if the operation fails.
Example 9: Security or trust check
In the Child Processes context, treat one value used by spawn vs exec as untrusted. Identify what must be validated, encoded, bounded, or refused before the value reaches a sensitive operation. Explain the consequence of trusting it blindly.
Example 10: Concurrency check
For Chapter 45, run or reason about two spawn vs exec operations close together. Ask whether ordering matters, whether shared state can conflict, and whether work should be awaited, queued, streamed, or moved to another worker.
Node.js coding example
// Topic: spawn vs exec
import os from 'node:os';
console.log({
platform: os.platform(),
parallelism: os.availableParallelism(),
topic: "spawn vs exec"
});Step-by-step code explanation
- Read platform information from the built-in os module.
- Ask Node.js for available parallelism rather than assuming a CPU count.
- Include the topic label so logs remain understandable.
- Use resource information as an input to design, not as a reason to create unlimited workers.
Expected output: An object showing the current platform, available parallelism, and topic.
Practice exercise
Build a small Chapter 45 example for spawn vs exec. Write the expected result before running it. Add one failure case, then change exactly one condition and explain why the behavior changed. For production reasoning, identify one limit, timeout, cleanup step, or validation rule that would make the code safer.
45.2 Streaming Child Process Output
Streaming Child Process Output is part of Chapter 45, “Child Processes.” For a beginner, the first goal is to understand the observable behavior before memorizing an API. In this lesson, concurrency means making progress on more than one task through processes, threads, or network I/O. The practical focus is chunks, flow control, and backpressure.
Compare the correct approach with a common alternative so the tradeoff is visible. In Chapter 45 (Child Processes), the useful comparison for Streaming Child Process Output is not “short code versus long code”; it is predictable behavior versus hidden assumptions. Check platform differences, lifetime of resources, and whether the caller must wait for completion.
For Streaming Child Process Output in Chapter 45, the mechanism to keep in mind is measuring resource cost and choosing isolation appropriate to the workload. A good experiment changes one thing at a time and checks both success and failure. When you finish this topic, you should be able to explain why the code works, not only copy the syntax.
Key terms in plain language
- concurrency — making progress on more than one task through processes, threads, or network I/O.
- Streaming — a concrete part of streaming child process output that the lesson isolates so you can see its effect instead of treating the whole feature as a black box.
- Child — a concrete part of streaming child process output that the lesson isolates so you can see its effect instead of treating the whole feature as a black box.
- Process — a concrete part of streaming child process output that the lesson isolates so you can see its effect instead of treating the whole feature as a black box.
10 teaching examples
Example 1: Production reasoning
Assume the Streaming Child Process Output code from Chapter 45 runs thousands of times. Decide what needs a timeout, limit, retry rule, cleanup step, metric, or graceful-shutdown hook. The goal is predictable behavior under repetition, load, and partial failure.
Example 2: Minimal working case
In Chapter 45 (Child Processes), build the smallest Streaming Child Process Output example that has one clear input and one visible result. Before running it, write what you expect to happen. Then verify chunks, flow control, and backpressure. This establishes a baseline you can reason about.
Example 3: Change one input
For Chapter 45 (Child Processes), keep the same program but change exactly one input related to Streaming Child Process Output. Compare the two outputs and explain why the change happened. This teaches cause and effect instead of memorizing syntax.
Example 4: Compare two approaches
Within Child Processes, solve one tiny task twice: first with the most direct approach to Streaming Child Process Output, then with a reasonable alternative. Compare readability, error behavior, and resource use. Choose the version whose tradeoff matches the task.
Example 5: Failure you can recognize
For Child Processes, create a safe failure involving Streaming Child Process Output, such as invalid data, a missing resource, a closed connection, or a rejected promise. Observe the error type and decide where the program should handle it rather than hiding it.
Example 6: Real service scenario
Imagine a small tutoring-service backend applying Streaming Child Process Output during Chapter 45 (Child Processes). State what arrives from the caller, what the Node.js process must do, what it returns, and what must be logged if the operation fails.
Example 7: Security or trust check
In the Child Processes context, treat one value used by Streaming Child Process Output as untrusted. Identify what must be validated, encoded, bounded, or refused before the value reaches a sensitive operation. Explain the consequence of trusting it blindly.
Example 8: Concurrency check
For Chapter 45, run or reason about two Streaming Child Process Output operations close together. Ask whether ordering matters, whether shared state can conflict, and whether work should be awaited, queued, streamed, or moved to another worker.
Example 9: Performance check
While studying Child Processes, measure the resource most affected by Streaming Child Process Output: elapsed time, bytes, memory, open connections, event-loop delay, or database round trips. Optimize only after the measurement identifies a meaningful cost.
Example 10: Refactoring example
In a Child Processes exercise, take code that mixes Streaming Child Process Output with unrelated business logic and split it into a small function with an explicit input and return value. The caller should not need to know low-level details unless they are part of the contract.
Node.js coding example
// Topic: Streaming Child Process Output
import os from 'node:os';
console.log({
platform: os.platform(),
parallelism: os.availableParallelism(),
topic: "Streaming Child Process Output"
});Step-by-step code explanation
- Read platform information from the built-in os module.
- Ask Node.js for available parallelism rather than assuming a CPU count.
- Include the topic label so logs remain understandable.
- Use resource information as an input to design, not as a reason to create unlimited workers.
Expected output: An object showing the current platform, available parallelism, and topic.
Practice exercise
Build a small Chapter 45 example for Streaming Child Process Output. Write the expected result before running it. Add one failure case, then change exactly one condition and explain why the behavior changed. For production reasoning, identify one limit, timeout, cleanup step, or validation rule that would make the code safer.
45.3 Passing Arguments Safely
Passing Arguments Safely is part of Chapter 45, “Child Processes.” For a beginner, the first goal is to understand the observable behavior before memorizing an API. In this lesson, concurrency means making progress on more than one task through processes, threads, or network I/O. The practical focus is inputs, observable output, error behavior, and the resource that the operation consumes.
Deliberately inspect a failure case because error behavior is part of the API. In Chapter 45 (Child Processes), a robust understanding of Passing Arguments Safely includes its failure path. Ask what happens with missing data, invalid input, a closed resource, cancellation, or partial completion. Handling those cases deliberately is part of correct Node.js design.
For Passing Arguments Safely in Chapter 45, the mechanism to keep in mind is measuring resource cost and choosing isolation appropriate to the workload. A good experiment changes one thing at a time and checks both success and failure. When you finish this topic, you should be able to explain why the code works, not only copy the syntax.
Key terms in plain language
- concurrency — making progress on more than one task through processes, threads, or network I/O.
- Passing — a concrete part of passing arguments safely that the lesson isolates so you can see its effect instead of treating the whole feature as a black box.
- Arguments — a concrete part of passing arguments safely that the lesson isolates so you can see its effect instead of treating the whole feature as a black box.
- Safely — a concrete part of passing arguments safely that the lesson isolates so you can see its effect instead of treating the whole feature as a black box.
10 teaching examples
Example 1: Change one input
For Chapter 45 (Child Processes), keep the same program but change exactly one input related to Passing Arguments Safely. Compare the two outputs and explain why the change happened. This teaches cause and effect instead of memorizing syntax.
Example 2: Compare two approaches
Within Child Processes, solve one tiny task twice: first with the most direct approach to Passing Arguments Safely, then with a reasonable alternative. Compare readability, error behavior, and resource use. Choose the version whose tradeoff matches the task.
Example 3: Failure you can recognize
For Child Processes, create a safe failure involving Passing Arguments Safely, such as invalid data, a missing resource, a closed connection, or a rejected promise. Observe the error type and decide where the program should handle it rather than hiding it.
Example 4: Real service scenario
Imagine a small tutoring-service backend applying Passing Arguments Safely during Chapter 45 (Child Processes). State what arrives from the caller, what the Node.js process must do, what it returns, and what must be logged if the operation fails.
Example 5: Security or trust check
In the Child Processes context, treat one value used by Passing Arguments Safely as untrusted. Identify what must be validated, encoded, bounded, or refused before the value reaches a sensitive operation. Explain the consequence of trusting it blindly.
Example 6: Concurrency check
For Chapter 45, run or reason about two Passing Arguments Safely operations close together. Ask whether ordering matters, whether shared state can conflict, and whether work should be awaited, queued, streamed, or moved to another worker.
Example 7: Performance check
While studying Child Processes, measure the resource most affected by Passing Arguments Safely: elapsed time, bytes, memory, open connections, event-loop delay, or database round trips. Optimize only after the measurement identifies a meaningful cost.
Example 8: Refactoring example
In a Child Processes exercise, take code that mixes Passing Arguments Safely with unrelated business logic and split it into a small function with an explicit input and return value. The caller should not need to know low-level details unless they are part of the contract.
Example 9: Production reasoning
Assume the Passing Arguments Safely code from Chapter 45 runs thousands of times. Decide what needs a timeout, limit, retry rule, cleanup step, metric, or graceful-shutdown hook. The goal is predictable behavior under repetition, load, and partial failure.
Example 10: Minimal working case
In Chapter 45 (Child Processes), build the smallest Passing Arguments Safely example that has one clear input and one visible result. Before running it, write what you expect to happen. Then verify inputs, observable output, error behavior, and the resource that the operation consumes. This establishes a baseline you can reason about.
Node.js coding example
// Topic: Passing Arguments Safely
import os from 'node:os';
console.log({
platform: os.platform(),
parallelism: os.availableParallelism(),
topic: "Passing Arguments Safely"
});Step-by-step code explanation
- Read platform information from the built-in os module.
- Ask Node.js for available parallelism rather than assuming a CPU count.
- Include the topic label so logs remain understandable.
- Use resource information as an input to design, not as a reason to create unlimited workers.
Expected output: An object showing the current platform, available parallelism, and topic.
Practice exercise
Build a small Chapter 45 example for Passing Arguments Safely. Write the expected result before running it. Add one failure case, then change exactly one condition and explain why the behavior changed. For production reasoning, identify one limit, timeout, cleanup step, or validation rule that would make the code safer.
45.4 Handling Exit Codes and Signals
Handling Exit Codes and Signals is part of Chapter 45, “Child Processes.” For a beginner, the first goal is to understand the observable behavior before memorizing an API. In this lesson, concurrency means making progress on more than one task through processes, threads, or network I/O. The practical focus is inputs, observable output, error behavior, and the resource that the operation consumes.
Connect the idea to a small service or automation task that a learner could actually build. In Chapter 45 (Child Processes), connect Handling Exit Codes and Signals to a small backend, automation script, or command-line tool. That makes the API easier to remember because each method call has a reason, a boundary, and an expected result.
For Handling Exit Codes and Signals in Chapter 45, the mechanism to keep in mind is measuring resource cost and choosing isolation appropriate to the workload. A good experiment changes one thing at a time and checks both success and failure. When you finish this topic, you should be able to explain why the code works, not only copy the syntax.
Key terms in plain language
- concurrency — making progress on more than one task through processes, threads, or network I/O.
- Handling — a concrete part of handling exit codes and signals that the lesson isolates so you can see its effect instead of treating the whole feature as a black box.
- Exit — a concrete part of handling exit codes and signals that the lesson isolates so you can see its effect instead of treating the whole feature as a black box.
- Codes — a concrete part of handling exit codes and signals that the lesson isolates so you can see its effect instead of treating the whole feature as a black box.
10 teaching examples
Example 1: Failure you can recognize
For Child Processes, create a safe failure involving Handling Exit Codes and Signals, such as invalid data, a missing resource, a closed connection, or a rejected promise. Observe the error type and decide where the program should handle it rather than hiding it.
Example 2: Real service scenario
Imagine a small tutoring-service backend applying Handling Exit Codes and Signals during Chapter 45 (Child Processes). State what arrives from the caller, what the Node.js process must do, what it returns, and what must be logged if the operation fails.
Example 3: Security or trust check
In the Child Processes context, treat one value used by Handling Exit Codes and Signals as untrusted. Identify what must be validated, encoded, bounded, or refused before the value reaches a sensitive operation. Explain the consequence of trusting it blindly.
Example 4: Concurrency check
For Chapter 45, run or reason about two Handling Exit Codes and Signals operations close together. Ask whether ordering matters, whether shared state can conflict, and whether work should be awaited, queued, streamed, or moved to another worker.
Example 5: Performance check
While studying Child Processes, measure the resource most affected by Handling Exit Codes and Signals: elapsed time, bytes, memory, open connections, event-loop delay, or database round trips. Optimize only after the measurement identifies a meaningful cost.
Example 6: Refactoring example
In a Child Processes exercise, take code that mixes Handling Exit Codes and Signals with unrelated business logic and split it into a small function with an explicit input and return value. The caller should not need to know low-level details unless they are part of the contract.
Example 7: Production reasoning
Assume the Handling Exit Codes and Signals code from Chapter 45 runs thousands of times. Decide what needs a timeout, limit, retry rule, cleanup step, metric, or graceful-shutdown hook. The goal is predictable behavior under repetition, load, and partial failure.
Example 8: Minimal working case
In Chapter 45 (Child Processes), build the smallest Handling Exit Codes and Signals example that has one clear input and one visible result. Before running it, write what you expect to happen. Then verify inputs, observable output, error behavior, and the resource that the operation consumes. This establishes a baseline you can reason about.
Example 9: Change one input
For Chapter 45 (Child Processes), keep the same program but change exactly one input related to Handling Exit Codes and Signals. Compare the two outputs and explain why the change happened. This teaches cause and effect instead of memorizing syntax.
Example 10: Compare two approaches
Within Child Processes, solve one tiny task twice: first with the most direct approach to Handling Exit Codes and Signals, then with a reasonable alternative. Compare readability, error behavior, and resource use. Choose the version whose tradeoff matches the task.
Node.js coding example
// Topic: Handling Exit Codes and Signals
import os from 'node:os';
console.log({
platform: os.platform(),
parallelism: os.availableParallelism(),
topic: "Handling Exit Codes and Signals"
});Step-by-step code explanation
- Read platform information from the built-in os module.
- Ask Node.js for available parallelism rather than assuming a CPU count.
- Include the topic label so logs remain understandable.
- Use resource information as an input to design, not as a reason to create unlimited workers.
Expected output: An object showing the current platform, available parallelism, and topic.
Practice exercise
Build a small Chapter 45 example for Handling Exit Codes and Signals. Write the expected result before running it. Add one failure case, then change exactly one condition and explain why the behavior changed. For production reasoning, identify one limit, timeout, cleanup step, or validation rule that would make the code safer.
45.5 Avoiding Shell Injection
Avoiding Shell Injection is part of Chapter 45, “Child Processes.” For a beginner, the first goal is to understand the observable behavior before memorizing an API. In this lesson, concurrency means making progress on more than one task through processes, threads, or network I/O. The practical focus is untrusted input, origin rules, least privilege, and abuse cases.
Finish by asking what changes when the code runs repeatedly, concurrently, or with untrusted input. In Chapter 45 (Child Processes), production code using Avoiding Shell Injection should be reviewable by another developer. Keep responsibilities small, add limits around untrusted or repeated work, and record enough context to diagnose failures without exposing secrets.
For Avoiding Shell Injection in Chapter 45, the mechanism to keep in mind is measuring resource cost and choosing isolation appropriate to the workload. A good experiment changes one thing at a time and checks both success and failure. When you finish this topic, you should be able to explain why the code works, not only copy the syntax.
Key terms in plain language
- concurrency — making progress on more than one task through processes, threads, or network I/O.
- Avoiding — a concrete part of avoiding shell injection that the lesson isolates so you can see its effect instead of treating the whole feature as a black box.
- Shell — a concrete part of avoiding shell injection that the lesson isolates so you can see its effect instead of treating the whole feature as a black box.
- Injection — a concrete part of avoiding shell injection that the lesson isolates so you can see its effect instead of treating the whole feature as a black box.
10 teaching examples
Example 1: Security or trust check
In the Child Processes context, treat one value used by Avoiding Shell Injection as untrusted. Identify what must be validated, encoded, bounded, or refused before the value reaches a sensitive operation. Explain the consequence of trusting it blindly.
Example 2: Concurrency check
For Chapter 45, run or reason about two Avoiding Shell Injection operations close together. Ask whether ordering matters, whether shared state can conflict, and whether work should be awaited, queued, streamed, or moved to another worker.
Example 3: Performance check
While studying Child Processes, measure the resource most affected by Avoiding Shell Injection: elapsed time, bytes, memory, open connections, event-loop delay, or database round trips. Optimize only after the measurement identifies a meaningful cost.
Example 4: Refactoring example
In a Child Processes exercise, take code that mixes Avoiding Shell Injection with unrelated business logic and split it into a small function with an explicit input and return value. The caller should not need to know low-level details unless they are part of the contract.
Example 5: Production reasoning
Assume the Avoiding Shell Injection code from Chapter 45 runs thousands of times. Decide what needs a timeout, limit, retry rule, cleanup step, metric, or graceful-shutdown hook. The goal is predictable behavior under repetition, load, and partial failure.
Example 6: Minimal working case
In Chapter 45 (Child Processes), build the smallest Avoiding Shell Injection example that has one clear input and one visible result. Before running it, write what you expect to happen. Then verify untrusted input, origin rules, least privilege, and abuse cases. This establishes a baseline you can reason about.
Example 7: Change one input
For Chapter 45 (Child Processes), keep the same program but change exactly one input related to Avoiding Shell Injection. Compare the two outputs and explain why the change happened. This teaches cause and effect instead of memorizing syntax.
Example 8: Compare two approaches
Within Child Processes, solve one tiny task twice: first with the most direct approach to Avoiding Shell Injection, then with a reasonable alternative. Compare readability, error behavior, and resource use. Choose the version whose tradeoff matches the task.
Example 9: Failure you can recognize
For Child Processes, create a safe failure involving Avoiding Shell Injection, such as invalid data, a missing resource, a closed connection, or a rejected promise. Observe the error type and decide where the program should handle it rather than hiding it.
Example 10: Real service scenario
Imagine a small tutoring-service backend applying Avoiding Shell Injection during Chapter 45 (Child Processes). State what arrives from the caller, what the Node.js process must do, what it returns, and what must be logged if the operation fails.
Node.js coding example
// Topic: Avoiding Shell Injection
import os from 'node:os';
console.log({
platform: os.platform(),
parallelism: os.availableParallelism(),
topic: "Avoiding Shell Injection"
});Step-by-step code explanation
- Read platform information from the built-in os module.
- Ask Node.js for available parallelism rather than assuming a CPU count.
- Include the topic label so logs remain understandable.
- Use resource information as an input to design, not as a reason to create unlimited workers.
Expected output: An object showing the current platform, available parallelism, and topic.
Practice exercise
Build a small Chapter 45 example for Avoiding Shell Injection. Write the expected result before running it. Add one failure case, then change exactly one condition and explain why the behavior changed. For production reasoning, identify one limit, timeout, cleanup step, or validation rule that would make the code safer.
Chapter 45 review — 20 questions and answers
1. What is the main purpose of spawn vs exec?
Answer: Its purpose is to make spawn vs exec explicit and observable so the program can use it predictably rather than relying on hidden assumptions.
2. What should a beginner identify before using spawn vs exec?
Answer: Identify the input, expected output, completion signal, possible error, and any resource that must be released.
3. Why is error handling important for spawn vs exec?
Answer: Because real inputs and resources fail. Correct code defines how the failure is reported and what cleanup still must happen.
4. How can you test spawn vs exec safely?
Answer: Start with a tiny deterministic case, test one failure case, then add concurrency or untrusted input only after the baseline is understood.
5. What is the main purpose of Streaming Child Process Output?
Answer: Its purpose is to make Streaming Child Process Output explicit and observable so the program can use it predictably rather than relying on hidden assumptions.
6. What should a beginner identify before using Streaming Child Process Output?
Answer: Identify the input, expected output, completion signal, possible error, and any resource that must be released.
7. Why is error handling important for Streaming Child Process Output?
Answer: Because real inputs and resources fail. Correct code defines how the failure is reported and what cleanup still must happen.
8. How can you test Streaming Child Process Output safely?
Answer: Start with a tiny deterministic case, test one failure case, then add concurrency or untrusted input only after the baseline is understood.
9. What is the main purpose of Passing Arguments Safely?
Answer: Its purpose is to make Passing Arguments Safely explicit and observable so the program can use it predictably rather than relying on hidden assumptions.
10. What should a beginner identify before using Passing Arguments Safely?
Answer: Identify the input, expected output, completion signal, possible error, and any resource that must be released.
11. Why is error handling important for Passing Arguments Safely?
Answer: Because real inputs and resources fail. Correct code defines how the failure is reported and what cleanup still must happen.
12. How can you test Passing Arguments Safely safely?
Answer: Start with a tiny deterministic case, test one failure case, then add concurrency or untrusted input only after the baseline is understood.
13. What is the main purpose of Handling Exit Codes and Signals?
Answer: Its purpose is to make Handling Exit Codes and Signals explicit and observable so the program can use it predictably rather than relying on hidden assumptions.
14. What should a beginner identify before using Handling Exit Codes and Signals?
Answer: Identify the input, expected output, completion signal, possible error, and any resource that must be released.
15. Why is error handling important for Handling Exit Codes and Signals?
Answer: Because real inputs and resources fail. Correct code defines how the failure is reported and what cleanup still must happen.
16. How can you test Handling Exit Codes and Signals safely?
Answer: Start with a tiny deterministic case, test one failure case, then add concurrency or untrusted input only after the baseline is understood.
17. What is the main purpose of Avoiding Shell Injection?
Answer: Its purpose is to make Avoiding Shell Injection explicit and observable so the program can use it predictably rather than relying on hidden assumptions.
18. What should a beginner identify before using Avoiding Shell Injection?
Answer: Identify the input, expected output, completion signal, possible error, and any resource that must be released.
19. Why is error handling important for Avoiding Shell Injection?
Answer: Because real inputs and resources fail. Correct code defines how the failure is reported and what cleanup still must happen.
20. How can you test Avoiding Shell Injection safely?
Answer: Start with a tiny deterministic case, test one failure case, then add concurrency or untrusted input only after the baseline is understood.