T09 · Insecure Skill Coding Practices
Error
- Location
vite.config.ts:82- Finding
Unauthenticated Network-Accessible OS Command Injection
- Content
View full analysis
{ console.log('[API] Received request:', req.method, req.url); if (req.method !== 'POST') { console.log('[API] Method not allowed:', req.method); res.statusCode = 405; res.end('Method Not Allowed'); return; } let body = ''; req.on('data', chunk => { body += chunk.toString(); }); req.on('end', async () => { try { console.log('[API] Request body:', body); const { projectId } = JSON.parse(body); if (!projectId) { console.log('[API] Missing projectId'); res.statusCode = 400; res.setHeader('Content-Type', 'application/json'); res.end(JSON.stringify({ error: 'projectId is required' })); return; } console.log(`[API] Starting audio generation for project: ${projectId}`); const scriptPath = path.resolve(process.cwd(), 'scripts/generate-audio.ts'); const command = `npx tsx "${scriptPath}" ${projectId}`; try { const { stdout, stderr } = await execAsync(command); if (stderr) { console.error('[API] Script stderr:', stderr); } res.setHeader('Content-Type', 'application/json'); res.end(JSON.stringify({ success: true, message: `Audio generation completed for ${projectId}`, output: stdout })); } catch (execError: any) { res.statusCode = 500; res.setHeader('Content-Type', 'application/json'); res.end(JSON.stringify({ error: 'Audio generation failed', details: execError.message, stderr: execError.stderr })); } } catch (error: any) { res.statusCode = 500; ...[truncated 2252 chars]- Remediation
View remediation