add the TODO

Signed-off-by: Matt Strapp <matt@mattstrapp.net>

1 files changed, 5 insertions, 1 deletions

diff --git a/src/routes/api.ts b/src/routes/api.ts
index 1e9cd49..c538751 100644
--- a/src/routes/api.ts
+++ b/src/routes/api.ts
@@ -87,7 +87,11 @@ api.route('/actuate')
 
         const escaped = quote([ 'python', req.body.path]);
         // Run the code
-        exec(escaped, (err, stdout, stderr) => {
+        /*
+            TODO: MAKE THIS MORE SECURE
+            Execing random things is probably a bad idea, and snyk is complaining that it isn't escaped properly.
+        */
+            exec(escaped, (err, stdout, stderr) => {
             if (err)
                 return res.status(500).json({ error: 'An unknown error occurred while executing the file.', error_msg: stderr });