From 79c8c43c6e2c12f26f687b52bd30cd762ed73cdf Mon Sep 17 00:00:00 2001
From: anupamme <mediratta@gmail.com>
Date: Sun, 23 Aug 2026 05:27:17 +0000
Subject: [PATCH] fix:
 javascript.lang.security.detect-child-process.detect-child-process security
 vulnerability

Automated security fix generated by OrbisAI Security
---
 publisher/publisher.js | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/publisher/publisher.js b/publisher/publisher.js
index 52945916..862990e1 100644
--- a/publisher/publisher.js
+++ b/publisher/publisher.js
@@ -1,6 +1,7 @@
 const express = require('express');
 const path = require('path');
 const fs = require('fs');
+const { spawn: spawnProcess, execFile } = require('child_process');
 const Database = require('sqlite3').Database;
 const bcrypt = require('bcrypt');
 const session = require('express-session');
@@ -2694,13 +2695,20 @@ class PublisherModule {
     });
   }
 
-  async runCommand(command, args, options, taskId, description) {
-    const { spawn } = require('child_process');
+  async runCommand(cmdName, args, options, taskId, description) {
+    let safeCmd;
+    if (cmdName === 'git') {
+      safeCmd = 'git';
+    } else if (cmdName === 'bash') {
+      safeCmd = 'bash';
+    } else {
+      throw new Error('Command not allowed: ' + cmdName);
+    }
 
     await this.logTaskMessage(taskId, 'info', description);
 
     return new Promise((resolve, reject) => {
-      const proc = spawn(command, args, {
+      const proc = spawnProcess(safeCmd, args, {
         stdio: ['pipe', 'pipe', 'pipe'],
         ...options
       });