From a13c135792e016117d285ce3338d784f13b863ee Mon Sep 17 00:00:00 2001
From: anupamme <mediratta@gmail.com>
Date: Fri, 28 Aug 2026 21:09:43 +0000
Subject: [PATCH] fix:
 javascript.lang.security.detect-child-process.detect-child-process security
 vulnerability

Automated security fix generated by OrbisAI Security
---
 integrity.js | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/integrity.js b/integrity.js
index a9d58900..cc287821 100644
--- a/integrity.js
+++ b/integrity.js
@@ -34,7 +34,9 @@ function getSums (data) {
 function getFile (url) {
   // the "easy way"; returns file buffer
   const filename = url.substring(url.lastIndexOf('/')+1)
-  cp.execSync(`curl -Lso /tmp/${filename} ${url}`)
+  // use execFileSync (no shell) with an argument array so the url/filename
+  // cannot be interpreted as shell metacharacters, preventing command injection
+  cp.execFileSync('curl', ['-Lso', `/tmp/${filename}`, url])
   const contents = fs.readFileSync(`/tmp/${filename}`)
   fs.unlinkSync(`/tmp/${filename}`) // delete tmp file
   return contents