Skip to content

Commit

Permalink
Update server.ts
Browse files Browse the repository at this point in the history
  • Loading branch information
donavanbecker committed Jan 22, 2024
1 parent af16a63 commit 34ee7f5
Showing 1 changed file with 19 additions and 2 deletions.
21 changes: 19 additions & 2 deletions src/homebridge-ui/server.ts
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@ import { request } from 'undici';
import { createServer } from 'http';
import fs from 'fs';
import url from 'node:url';
import { exec } from 'child_process';

class PluginUiServer extends HomebridgePluginUiServer {
public key!: string;
Expand Down Expand Up @@ -32,7 +33,7 @@ class PluginUiServer extends HomebridgePluginUiServer {
}
case 'auth': {
if (query.code) {
try {
/*try {
const code = query.code;
const auth = Buffer.from(this.key + ':' + this.secret).toString('base64');
const { body, statusCode } = await request(TokenURL, {
Expand All @@ -49,7 +50,23 @@ class PluginUiServer extends HomebridgePluginUiServer {
method: 'POST',
});
const response: any = await body.json();
console.log(`(Token) ${response}: ${JSON.stringify(response)}, statusCode: ${statusCode}`);
console.log(`(Token) ${response}: ${JSON.stringify(response)}, statusCode: ${statusCode}`);*/
const code = query.code;
const auth = Buffer.from(this.key + ':' + this.secret).toString('base64');
let curlString = '';
curlString += 'curl -X POST ';
curlString += '--header "Authorization: Basic ' + auth + '" ';
curlString += '--header "Accept: application/json" ';
curlString += '--header "Content-Type: application/x-www-form-urlencoded" ';
curlString += '-d "';
curlString += 'grant_type=authorization_code&';
curlString += 'code=' + code + '&';
curlString += 'redirect_uri=' + encodeURI('http://' + this.hostname + ':8585/auth');
curlString += '" ';
curlString += '"https://api.honeywell.com/oauth2/token"';
try {
const { stdout } = await exec(curlString);

Check failure

Code scanning / CodeQL

Uncontrolled command line Critical

This command line depends on a
user-provided value
.
const response = JSON.parse(String(stdout));
if (response.access_token) {
this.pushEvent('creds-received', {
access: response.access_token,
Expand Down

0 comments on commit 34ee7f5

Please sign in to comment.