When code crosses security boundaries (HTTP auth, subprocess execution, or policy-driven external side effects), it must follow the established secure path and validate before acting.
Use the project’s authenticated transport: Don’t bypass SDK helpers with ad-hoc fetch/manual token headers. Forward extra headers (e.g., locale) via the helper’s options so cookie-based/OAuth flows remain intact.
// Prefer the SDK helper that preserves cookie/OAuth behavior
return SDK.fetchJSON(url, {
method: 'GET',
headers: {
...(locale && locale !== 'en' ? { 'Accept-Language': locale } : {}),
// do not manually inject window tokens if the SDK already handles auth
},
});
Prevent command injection: Never build a shell command string from untrusted inputs. Use argument-vector subprocess APIs.
// Unsafe (shell string composition): avoid
// execSync(`ffmpeg -i "${file}" ...`)
// Safe: argument array
execFileSync('ffmpeg', ['-i', filePath, /* ... */], { stdio: 'inherit' });
Gate privileged side effects: Validate authorization/policy and required identifiers before queueing or emitting actions. Only collect/execute the side effect after admission checks pass.
const queued = [];
for (const msg of messages) {
if (!msg.key || msg.key.fromMe) continue;
const chatId = msg.key.remoteJid;
if (!chatId || chatId.endsWith('@broadcast') || chatId.endsWith('@g.us')) continue;
// enqueue only after policy gates/allowlists have been applied
if (passesAdmissionChecks(msg)) queued.push(msg.key);
}
Apply these rules consistently to reduce auth regressions (401/OAuth gating), injection risk, and inadvertent disclosure/side effects from policy mistakes.