HardPro challengeJavaScriptTypeScript

Fix Command Injection

Node.jsSecurity

The function below prepares a shell command by concatenating a script path with a user-supplied argument — the exact shape you'd hand to child_process.exec().

The bug: an attacker can pass "&& rm -rf /" as the argument. Once concatenated into a single shell string, the shell interprets && as a command separator and runs the attacker's payload.

Your task: fix solve(scriptPath, userArg) so it returns a command descriptor instead of a shell string:

// Expected return shape — safe for child_process.execFile() / spawn()
{ cmd: scriptPath, args: ['--option', userArg] }

userArg must only ever appear as an array element, never concatenated into a string — that's what keeps shell metacharacters inert.

Sample tests

Test #1Normal filename argument
Input: ["/opt/scripts/resize.sh","photo.jpg"]
Output: {"cmd":"/opt/scripts/resize.sh","args":["--option","photo.jpg"]}
Test #2Command chaining payload stays inert inside args
Input: ["/opt/scripts/resize.sh","&& rm -rf /"]
Output: {"cmd":"/opt/scripts/resize.sh","args":["--option","&& rm -rf /"]}
Test #3Empty argument
Input: ["script.sh",""]
Output: {"cmd":"script.sh","args":["--option",""]}