Merge pull request #5 from squaredup/INT-002-more-code-alerts

INT-002-more-code-alerts

Author: TimWheeler-SQUP

src/Config/config.js

@@ -1,3 +1,3 @@
 // AWS Access Key and Secret Key for testing Secret Scanning.
-const AWS_ACCESS_KEY_ID = "AKIA12345678907890";
-const AWS_SECRET_ACCESS_KEY = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYRGR444";
+const AWS_ACCESS_KEY_ID = "AKIA123456789078905L";
+const AWS_SECRET_ACCESS_KEY = "IHF+fhtWyjceTso+J4/o4zQttW7dxYrjCnLG9KqC";

src/api/handler.ts

@@ -0,0 +1,12 @@
+// somewhere under src/ (e.g. src/api/handler.ts)
+import { runUserCommand } from '../utils/child_process';
+import express from 'express';
+
+const app = express();
+app.get('/run', (req, res) => {
+  // req.query.cmd is a recognised taint source
+  runUserCommand(String(req.query.cmd));
+  res.send('ok');
+});
+
+export default app;