Command Injection

// Node.js/Express - Secure command execution

const { spawn } = require('child_process');
const path = require('path');
const fs = require('fs').promises;

// SECURE: File viewing without shell execution
app.get('/view-file', async (req, res) => {
  const filename = req.query.name;
  
  // SECURE: Strict allow-list validation
  // Only allow alphanumeric, underscore, dash, and dot
  if (!/^[a-zA-Z0-9_.-]{1,64}$/.test(filename)) {
    return res.status(400).json({ error: 'Invalid filename format' });
  }
  
  // SECURE: Use safe file reading with constrained base path
  const BASE_DIR = '/srv/docs';
  const fullPath = path.join(BASE_DIR, filename);
  
  // SECURE: Verify path stays within base directory
  const realPath = await fs.realpath(fullPath).catch(() => null);
  if (!realPath || !realPath.startsWith(BASE_DIR)) {
    return res.status(400).json({ error: 'Invalid file path' });
  }
  
  try {
    // SECURE: Use language library instead of shell command
    const content = await fs.readFile(realPath, 'utf8');
    res.type('text/plain').send(content);
  } catch (error) {
    res.status(404).json({ error: 'File not found' });
  }
});

// SECURE: Archive extraction with spawn and argv array
app.post('/extract-zip', async (req, res) => {
  const zipFile = req.body.filename;
  
  // SECURE: Validate filename format
  if (!/^[a-zA-Z0-9_-]{1,64}\.zip$/.test(zipFile)) {
    return res.status(400).json({ error: 'Invalid filename' });
  }
  
  // SECURE: Fixed base paths
  const UPLOAD_DIR = '/srv/uploads';
  const EXTRACT_DIR = '/srv/extracted';
  const zipPath = path.join(UPLOAD_DIR, zipFile);
  
  // SECURE: Verify file exists and is within upload directory
  try {
    const stat = await fs.stat(zipPath);
    if (!stat.isFile()) {
      return res.status(400).json({ error: 'Not a file' });
    }
  } catch (error) {
    return res.status(404).json({ error: 'File not found' });
  }
  
  // SECURE: Use spawn with argv array, shell explicitly disabled
  // Arguments passed as array - no shell interpretation possible!
  const unzip = spawn('unzip', ['-q', zipPath, '-d', EXTRACT_DIR], {
    shell: false,  // CRITICAL: Disable shell
    timeout: 30000  // Prevent hanging
  });
  
  let stdout = '';
  let stderr = '';
  
  unzip.stdout.on('data', (data) => {
    stdout += data;
  });
  
  unzip.stderr.on('data', (data) => {
    stderr += data;
  });
  
  unzip.on('close', (code) => {
    if (code === 0) {
      res.json({ message: 'Extracted successfully' });
    } else {
      res.status(500).json({ error: 'Extraction failed' });
    }
  });
  
  unzip.on('error', (error) => {
    res.status(500).json({ error: 'Process error' });
  });
});

// SECURE: Ping utility with strict validation
app.get('/ping', (req, res) => {
  const host = req.query.host;
  
  // SECURE: Very strict hostname/IP validation
  // Allow only valid hostname or IPv4 format
  const hostnameRegex = /^[a-zA-Z0-9.-]{1,253}$/;
  const ipv4Regex = /^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$/;
  
  if (!hostnameRegex.test(host) && !ipv4Regex.test(host)) {
    return res.status(400).json({ error: 'Invalid host format' });
  }
  
  // SECURE: Additional length check
  if (host.length > 253) {
    return res.status(400).json({ error: 'Host too long' });
  }
  
  // SECURE: Use spawn with argv array, no shell
  const ping = spawn('ping', ['-c', '4', '-W', '2', host], {
    shell: false,  // CRITICAL: No shell = no injection
    timeout: 10000
  });
  
  let output = '';
  
  ping.stdout.on('data', (data) => {
    output += data.toString();
  });
  
  ping.on('close', (code) => {
    // SECURE: Return structured data, not raw output
    res.json({
      host: host,
      reachable: code === 0,
      output: output.substring(0, 1000)  // Limit output size
    });
  });
  
  ping.on('error', (error) => {
    res.status(500).json({ error: 'Ping failed' });
  });
});

// SECURE: Better approach - avoid shell commands entirely
// Use pure JavaScript/library implementations when possible
const dns = require('dns').promises;

app.get('/check-host', async (req, res) => {
  const hostname = req.query.host;
  
  // Validate format
  if (!/^[a-zA-Z0-9.-]{1,253}$/.test(hostname)) {
    return res.status(400).json({ error: 'Invalid hostname' });
  }
  
  try {
    // SECURE: Use Node.js DNS module - no shell at all!
    const addresses = await dns.resolve4(hostname);
    res.json({ hostname, addresses, reachable: true });
  } catch (error) {
    res.json({ hostname, reachable: false, error: 'DNS lookup failed' });
  }
});