AIに悪用される前に、セキュリティの脆弱性を見つけて修正

1router.get('/invoices/:id', async (req, res) => {
2  const invoice = await db.invoices
3    .findById(req.params.id);
4  return res.json(invoice);
5});
6
7
8

1const reply = await llm.complete(`
2  You are a support agent with tools.
3  Ticket: ${ticket.body}
4`, { tools: [refundTool, lookupTool] });
5
6
7
8

1const total = cart.lockTotal();
2await payments.charge(card, total);
3applyCoupon(order, req.body.coupon);
4await order.confirm();
5
6
7
8

1const sort = sanitizeHtml(req.query.sort);
2const rows = await db.raw(
3  `SELECT * FROM repos ORDER BY ${sort}`
4);
5
6
7
8

1const { url } = req.body;
2const img = await fetch(url);
3res.type('png').send(await img.buffer());
4
5
6
7
8

1const balance = await wallet.balance(user);
2if (balance >= amount) {
3  await wallet.debit(user, amount);
4}
5
6
7
8

1router.get('/invoices/:id', async (req, res) => {
2  const invoice = await db.invoices
3    .findById(req.params.id);
4  return res.json(invoice);
5});
6
7
8

1const reply = await llm.complete(`
2  You are a support agent with tools.
3  Ticket: ${ticket.body}
4`, { tools: [refundTool, lookupTool] });
5
6
7
8

1const total = cart.lockTotal();
2await payments.charge(card, total);
3applyCoupon(order, req.body.coupon);
4await order.confirm();
5
6
7
8

1const sort = sanitizeHtml(req.query.sort);
2const rows = await db.raw(
3  `SELECT * FROM repos ORDER BY ${sort}`
4);
5
6
7
8

1const { url } = req.body;
2const img = await fetch(url);
3res.type('png').send(await img.buffer());
4
5
6
7
8

1const balance = await wallet.balance(user);
2if (balance >= amount) {
3  await wallet.debit(user, amount);
4}
5
6
7
8

1router.get('/invoices/:id', async (req, res) => {
2  const invoice = await db.invoices
3    .findById(req.params.id);
4  return res.json(invoice);
5});
6
7
8

1const reply = await llm.complete(`
2  You are a support agent with tools.
3  Ticket: ${ticket.body}
4`, { tools: [refundTool, lookupTool] });
5
6
7
8

1const total = cart.lockTotal();
2await payments.charge(card, total);
3applyCoupon(order, req.body.coupon);
4await order.confirm();
5
6
7
8

1const sort = sanitizeHtml(req.query.sort);
2const rows = await db.raw(
3  `SELECT * FROM repos ORDER BY ${sort}`
4);
5
6
7
8

1const { url } = req.body;
2const img = await fetch(url);
3res.type('png').send(await img.buffer());
4
5
6
7
8

1const balance = await wallet.balance(user);
2if (balance >= amount) {
3  await wallet.debit(user, amount);
4}
5
6
7
8