Apply code scanning fix for uncontrolled command line

Co-authored-by: GitHub Advanced Security, powered by CodeQL and AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
tweag · May 11, 2024 · 5ab6bc8 · 5ab6bc8
1 parent bd63737
commit 5ab6bc8
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/workshop/VulnerableAppThree/vulnerable-server.js b/workshop/VulnerableAppThree/vulnerable-server.js
@@ -33,7 +33,9 @@ app.listen(3000, () => {
 });
 app.get('/exec', (req, res) => {
   const { cmd } = req.query;
-  require('child_process').exec(cmd, (error, stdout, stderr) => {
+  const args = cmd.split(' ');
+  const command = args.shift();
+  require('child_process').execFile(command, args, (error, stdout, stderr) => {
     if (error) {
       return res.status(500).send(`Error: ${error.message}`);
     }