bug: fix OS command injection in POST /create identify call

[devin-ai-integration]

Summary

exports.create fed an attacker-controlled markdown image URL straight into exec('identify ' + url), i.e. /bin/sh -c, on an unauthenticated route — any ;, |, backtick or $(...) in the captured URL ran as a shell command.

• exec → execFile('identify', [url], cb): no shell, url is a single argv entry.
• New isInspectableImageUrl(url) gate before the sink: <=2048 chars, ^[A-Za-z0-9._~:/?#@%+=-]+$ (excludes whitespace and every shell metacharacter), and validator.isURL(url, {protocols:['http','https'], require_protocol:true}). Rejected URLs are logged and skipped; the todo is still saved.
• Regex capture tightened (http.*) → (http[^)\s]*) so the group can't swallow trailing markdown/payload text.

Auth was intentionally left unchanged — creating todos is the app's anonymous core flow; the fix removes the shell rather than the endpoint.

Testing

tests/create-command-injection.spec.js stubs child_process and the mongoose models, calls routes.create directly, and asserts no child process spawns for shell payloads (;, &&, backticks, newline, file://) while a benign http://example.com/snyk.png still yields execFile('identify', ['http://example.com/snyk.png']). 18/18 assertions pass.

Devin-Org: engineering

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review