fix: command injection in todo image identify (CWE-78)

routes/index.js

@@ -9,6 +9,7 @@
 var readline = require('readline');
 var moment = require('moment');
 var exec = require('child_process').exec;
+var execFile = require('child_process').execFile;
 var validator = require('validator');
 
 // zip-slip
@@ -149,57 +150,75 @@
   return t;
 }
 
+function isSafeImageUrl(url) {
+  if (typeof url !== 'string' || /[\s\r\n]/.test(url)) {
+    return false;
+  }
+
+  var parsed;
+  try {
+    parsed = new URL(url);
+  } catch (e) {
+    return false;
+  }
+
+  return parsed.protocol === 'http:' || parsed.protocol === 'https:';
+}
+
 exports.create = function (req, res, next) {
   // console.log('req.body: ' + JSON.stringify(req.body));
 
   var item = req.body.content;
   var imgRegex = /\!\[alt text\]\((http.*)\s\".*/;
   if (typeof (item) == 'string' && item.match(imgRegex)) {
     var url = item.match(imgRegex)[1];
     console.log('found img: ' + url);
 
-    exec('identify ' + url, function (err, stdout, stderr) {
-      console.log(err);
-      if (err !== null) {
-        console.log('Error (' + err + '):' + stderr);
-      }
-    });
+    if (isSafeImageUrl(url)) {
+      execFile('identify', [url], function (err, stdout, stderr) {
+        if (err !== null) {
+          console.log('Error (' + err + '):' + stderr);
+        }
+      });
+    } else {
+      console.log('skipping identify for unsupported url');
+    }
 
   } else {
     item = parse(item);
   }
 
   new Todo({
     content: item,
     updated_at: Date.now(),
   }).save(function (err, todo, count) {
     if (err) return next(err);
 
     /*
     res.setHeader('Data', todo.content.toString('base64'));
     res.redirect('/');
     */
 
     res.setHeader('Location', '/');
     res.status(302).send(todo.content.toString('base64'));
 
     // res.redirect('/#' + todo.content.toString('base64'));
   });
 };
 
 exports.destroy = function (req, res, next) {
   Todo.findById(req.params.id, function (err, todo) {
 
     try {
       todo.remove(function (err, todo) {
         if (err) return next(err);
         res.redirect('/');
       });
     } catch (e) {
     }
   });
 };
 
 exports.edit = function (req, res, next) {
   Todo.
     find({}).