code-injection-example

const exec = require('child_process').exec;
const fs = require('fs');
const safe_converter = require('safe_converter');
/*
 * Upload a video to be stored on the server.
 *
 * Makes use of the `safe_converter` library to convert the raw video
 * prior to removing the raw video from disc and returning an HTTP 200 status
 * code to the requester.
 */
app.post('/uploadVideo', function(req, res) {
 if (!session.isAuthenticated) { return res.sendStatus(401); }
 /*
  * Write the raw video data to disk, where it can be later
  * compressed and then removed from disk.
  */
   fs.writeFileSync(`/videos/raw/${req.body.name}`, req.body.video);
 /*
  * Convert the raw, unoptimized video—resulting in an optimized
  * video being generated.
  */
 safe_converter.convert(`/videos/raw/${req.body.name}`,
  `'/videos/converted/${req.body.name}`)
 .then(() => {
    /*
     * Remove the raw video file when it is no longer needed.
     * Keep the optimized video file.
     */
    exec(`rm /videos/raw/${req.body.name}`);
    return res.sendStatus(200);
  });
});