From 657fb1bd1f1c3ecc771cefefd3c7ca876d289cab Mon Sep 17 00:00:00 2001
From: Tang QI <tangqihy@gmail.com>
Date: Thu, 19 Mar 2026 19:55:39 +0800
Subject: [PATCH] fix(feishu): fix shell injection vulnerability - use
 spawnSync instead of execSync

---
 extensions/feishu/src/media.ts | 21 ++++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/extensions/feishu/src/media.ts b/extensions/feishu/src/media.ts
index f83d7e9442f..31913e3e918 100644
--- a/extensions/feishu/src/media.ts
+++ b/extensions/feishu/src/media.ts
@@ -1,7 +1,7 @@
 import fs from "fs";
 import path from "path";
 import { Readable } from "stream";
-import { execSync } from "child_process";
+import { spawnSync } from "child_process";
 import { withTempDownloadPath, type ClawdbotConfig } from "openclaw/plugin-sdk/feishu";
 import { resolveFeishuAccount } from "./accounts.js";
 import { createFeishuClient } from "./client.js";
@@ -471,13 +471,20 @@ export async function sendMediaFeishu(params: {
         // Try to get duration from the original file path if available
         const filePath = mediaUrl && !mediaUrl.startsWith("http") ? mediaUrl : undefined;
         if (filePath && fs.existsSync(filePath)) {
-          const durationSec = parseFloat(
-            execSync(`ffprobe -v error -show_entries format=duration -of default=noprint_wrappers=1:nokey=1 "${filePath}"`, {
-              encoding: "utf-8",
-              timeout: 10000,
-            }).trim()
+          const result = spawnSync(
+            "ffprobe",
+            [
+              "-v", "error",
+              "-show_entries", "format=duration",
+              "-of", "default=noprint_wrappers=1:nokey=1",
+              filePath,
+            ],
+            { encoding: "utf-8", timeout: 10000 }
           );
-          duration = Math.round(durationSec * 1000); // Convert to milliseconds
+          if (result.status === 0) {
+            const durationSec = parseFloat(result.stdout.trim());
+            duration = Math.round(durationSec * 1000); // Convert to milliseconds
+          }
         }
       } catch (e) {
         // Silently ignore ffprobe errors