Fix Command Injection in Blitz.js

import { exec } from 'child_process'
import { resolver } from '@blitzjs/rpc'
export default resolver.pipe(async ({ filename }) => {
// CRITICAL: User-controlled ‘filename’ is concatenated into a shell command
// An attacker can send: ‘file.txt; rm -rf /’
exec(ls -l ./uploads/${filename}, (err, stdout) => {
if (err) console.error(err)
console.log(stdout)
})
return { success: true }
})

import { spawn } from 'child_process'
import { resolver } from '@blitzjs/rpc'
import path from 'path'
export default resolver.pipe(async ({ filename }) => {
// 1. Sanitize: Extract only the base name to prevent path traversal
const safeName = path.basename(filename)
const uploadDir = path.join(process.cwd(), ‘uploads’)
// 2. Use spawn: Arguments are passed as an array, bypassing shell interpretation
return new Promise((resolve, reject) => {
const child = spawn(‘ls’, [‘-l’, path.join(uploadDir, safeName)])
let output = ''
child.stdout.on('data', (data) => (output += data))
child.on('close', (code) => {
  code === 0 ? resolve({ output }) : reject(new Error('Process failed'))
})
})
})