// ❌ UNSAFE: Never use exec() with string concatenation
import { exec } from "child_process";

const metadata = {
  title: userInput.title, // Could contain: "; rm -rf /"
  author: userInput.author, // Could contain: "| cat /etc/passwd"
};

exec(`pandoc --metadata title="${metadata.title}" input.md -o output.pdf`);

// ✅ SAFE: Use spawn() with argument arrays
import { spawn } from "child_process";

const args = [
  "--sandbox", // Security flag
  "--metadata",
  `title=${title}`, // Arguments as array elements
  "--metadata",
  `author=${author}`,
  "-o",
  outputPath,
  inputPath,
];

const pandoc = spawn("pandoc", args, { shell: false }); // Never use shell

// ✅ SAFE: Strict allowlist and validation
const METADATA_ALLOWLIST = ["title", "author", "date", "language", "publisher"];
const SAFE_CHAR_REGEX = /^[a-zA-Z0-9\s\-_.,'"()!?:;/@#&]+$/;

function sanitizeMetadata(metadata: Record<string, unknown>) {
  const sanitized: Record<string, string> = {};

  for (const [key, value] of Object.entries(metadata)) {
    // Only allow whitelisted fields
    if (!METADATA_ALLOWLIST.includes(key)) {
      console.error(
        `[SECURITY] Rejected metadata field not in allowlist: ${key}`,
      );
      continue;
    }

    // Convert to string and validate
    const strValue = String(value || "").trim();

    // Reject values with dangerous characters
    if (!SAFE_CHAR_REGEX.test(strValue)) {
      console.error(
        `[SECURITY] Rejected metadata value with unsafe characters: ${key}="${strValue}"`,
      );
      continue;
    }

    sanitized[key] = strValue;
  }

  return sanitized;
}

const args = [
  "--sandbox", // CRITICAL: Always first argument
  // ... other arguments
];

// ❌ UNSAFE PATTERNS - NEVER USE THESE:

// 1. Using exec() with string concatenation
exec(`command ${userInput}`);

// 2. Using shell: true
spawn("command", args, { shell: true });

// 3. Building command strings
const cmd = `pandoc ${options} ${input}`;
exec(cmd);

// 4. Template literals with user input
exec(`convert "${fileName}" output.pdf`);

// ✅ SAFE PATTERNS - ALWAYS USE THESE:

// 1. spawn() with argument arrays
spawn("command", ["--option", value], { shell: false });

// 2. execFile() for known executables
execFile("/usr/bin/pandoc", args);

// 3. Validate all inputs
if (VALID_OPTIONS.includes(option)) {
  args.push("--" + option);
}

// 4. Use absolute paths when possible
const pandocPath = "/usr/local/bin/pandoc";
spawn(pandocPath, args);

// ❌ UNSAFE: Accepting any input
function processFile(filename: string) {
  return spawn("cat", [filename]); // Could read /etc/passwd
}

// ✅ SAFE: Validate and restrict paths
function processFile(filename: string) {
  // Validate filename format
  if (!/^[a-zA-Z0-9-_]+\.(md|txt)$/.test(filename)) {
    throw new Error("Invalid filename");
  }

  // Ensure file is in allowed directory
  const safePath = path.join(ALLOWED_DIR, path.basename(filename));

  // Verify resolved path is still in allowed directory
  if (!safePath.startsWith(ALLOWED_DIR)) {
    throw new Error("Path traversal detected");
  }

  return spawn("cat", [safePath]);
}

const DANGEROUS_CHARS = [
  ";", // Command separator
  "|", // Pipe
  "&", // Background/chain commands
  "$", // Variable expansion
  "`", // Command substitution (backticks)
  "\\", // Escape character
  "\n", // Newline (can break out of quotes)
  "\r", // Carriage return
  ">", // Redirect output
  "<", // Redirect input
  "(", // Subshell
  ")", // Subshell
  "{", // Brace expansion
  "}", // Brace expansion
  "[", // Glob pattern
  "]", // Glob pattern
  "*", // Wildcard
  "?", // Wildcard
  "~", // Home directory expansion
  "!", // History expansion (in some shells)
];

// Example security test cases
describe("Security Tests", () => {
  const dangerousInputs = [
    "; rm -rf /",
    "| cat /etc/passwd",
    "$(whoami)",
    "`ls -la`",
    "../../../etc/passwd",
    "test && echo hacked",
    "test || echo failed",
    "test; echo done",
  ];

  test.each(dangerousInputs)(
    "should reject dangerous input: %s",
    async (input) => {
      await expect(processUserInput(input)).rejects.toThrow(/unsafe|invalid/i);
    },
  );
});

// Next.js security headers example
const securityHeaders = [
  {
    key: "X-Content-Type-Options",
    value: "nosniff",
  },
  {
    key: "X-Frame-Options",
    value: "DENY",
  },
  {
    key: "X-XSS-Protection",
    value: "1; mode=block",
  },
  {
    key: "Referrer-Policy",
    value: "strict-origin-when-cross-origin",
  },
  {
    key: "Content-Security-Policy",
    value:
      "default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline';",
  },
];