Avoid shell execution in kill

src/kill.js

@@ -18,19 +18,28 @@
  * export declare function kill(pid: number): void;
  */
 
-_('isWindows');
+_('isWindows isInt toNum');
 
 const childProcess = require('child_process');
 
 exports = function(pid) {
     try {
-        let cmd = '';
+        pid = toNum(pid);
+        if (!isInt(pid) || pid <= 0) {
+            throw new TypeError('Invalid pid');
+        }
+
         if (isWindows) {
-            cmd = `taskkill /pid ${pid} /T /F`;
+            childProcess.spawnSync(
+                'taskkill',
+                ['/pid', String(pid), '/T', '/F'],
+                {
+                    stdio: 'ignore'
+                }
+            );
         } else {
-            cmd = `kill ${pid} -9`;
+            process.kill(pid, 'SIGKILL');
         }
-        childProcess.execSync(cmd);
     } catch (e) {
         /* eslint-disable no-empty */
     }

test/kill.js

@@ -11,3 +11,37 @@ it('basic', done => {
 
     kill(subProcess.pid);
 });
+
+it('only accepts numeric pids', () => {
+    const childProcess = require('child_process');
+    const originalProcessKill = process.kill;
+    const originalSpawnSync = childProcess.spawnSync;
+    let called = false;
+
+    try {
+        if (process.platform === 'win32') {
+            childProcess.spawnSync = (cmd, args) => {
+                called = true;
+                expect(cmd).to.equal('taskkill');
+                expect(args).to.eql(['/pid', '123', '/T', '/F']);
+                return {};
+            };
+        } else {
+            process.kill = pid => {
+                called = true;
+                expect(pid).to.equal(123);
+                return true;
+            };
+        }
+
+        kill('123');
+        expect(called).to.be.true;
+
+        called = false;
+        kill('123; touch VULNERABLE_MARKER');
+        expect(called).to.be.false;
+    } finally {
+        process.kill = originalProcessKill;
+        childProcess.spawnSync = originalSpawnSync;
+    }
+});