feat: sanitize file checks

server/src/containers/cli.js

@@ -1,16 +1,32 @@
-import { exec } from 'child_process'
+import { execFile } from 'child_process'
 
 import { buildFileCheckCmd } from '@linux-odyssey/utils'
 
+function sanitizeId(id) {
+  return id.replace(/[^a-zA-Z0-9]/g, '')
+}
+
 // eslint-disable-next-line import/prefer-default-export
-export function checkFiles(id, files) {
-  return new Promise((resolve) => {
-    const cmd = buildFileCheckCmd(files)
-    // WARNING: This is not secure!
-    exec(`docker exec ${id} ${cmd}`, (error, stdout, stderr) => {
-      console.log('stdout', stdout)
-      console.log('stderr', stderr)
-      resolve(!error)
-    })
+export function checkFile(id, file) {
+  return new Promise((resolve, reject) => {
+    const cmd = buildFileCheckCmd(file)
+    console.log(cmd)
+    // WARNING: This is vulnerable to command injection
+    execFile(
+      'docker',
+      ['exec', sanitizeId(id), ...cmd],
+      { timeout: 1000 },
+      (error, stdout, stderr) => {
+        if (stderr) console.log('error', error)
+        if (stdout) console.log('stdout', stdout)
+        if (error) console.log('error', error)
+        const exists = !error
+        if (exists === file.exists) {
+          resolve(true)
+        } else {
+          reject(new Error('File check failed'))
+        }
+      }
+    )
   })
 }