fix: command injection in todo image identify (CWE-78)

[devin-ai-integration]

Summary

exports.create in routes/index.js passed a user-controlled URL, taken from todo content, straight into a shell string: exec('identify ' + url, ...), so any shell metacharacter in the URL ran as OS commands.

The sink now uses execFile with an argv array (no shell) and validates the URL first:

- exec('identify ' + url, cb)
+ if (isSafeImageUrl(url)) execFile('identify', [url], cb)

isSafeImageUrl rejects non-strings/whitespace and requires new URL(url).protocol to be http:/https: — which also prevents the argument from being interpreted as an ImageMagick option (-write ...) or a local file:/path read.

Written by Devin

Devin-Org: engineering

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review