Merge pull request 'improve(tts-voice): avoid shell-based curl execution in auth/health checks' (#4) from yucheng/openclaw-skill:improve/tts-voice-safe-curl-spawn into main

skills/tts-voice/handler.ts

@@ -8,7 +8,7 @@
  *   - curl CLI
  */
 
-import { execSync, spawnSync } from 'child_process';
+import { spawnSync } from 'child_process';
 import { readFileSync, existsSync, unlinkSync } from 'fs';
 
 const LUXTTS_BASE = 'http://localhost:7860';
@@ -56,13 +56,22 @@ function ensureCookie(): boolean {
   if (!pass) return false;
 
   try {
-    execSync(
+    const result = spawnSync(
-      `curl -s -o /dev/null -w "%{http_code}" -c ${COOKIE_JAR} ` +
+      'curl',
-      `-d "username=${user}&password=${pass}" ` +
+      [
+        '-s',
+        '-o', '/dev/null',
+        '-w', '%{http_code}',
+        '-c', COOKIE_JAR,
+        '-X', 'POST',
+        '-d', `username=${user}&password=${pass}`,
         `${LUXTTS_BASE}/luxtts/login`,
-      { timeout: 10000 }
+      ],
+      { timeout: 10000, encoding: 'utf-8' }
     );
-    return existsSync(COOKIE_JAR);
+
+    const httpCode = (result.stdout || '').trim();
+    return result.status === 0 && httpCode === '200' && existsSync(COOKIE_JAR);
   } catch {
     return false;
   }
@@ -71,11 +80,14 @@ function ensureCookie(): boolean {
 /** Check if LuxTTS service is alive */
 function healthCheck(): boolean {
   try {
-    const result = execSync(
+    const result = spawnSync(
-      `curl -s -o /dev/null -w "%{http_code}" ${LUXTTS_BASE}/luxtts/api/health`,
+      'curl',
-      { timeout: 5000 }
+      ['-s', '-o', '/dev/null', '-w', '%{http_code}', `${LUXTTS_BASE}/luxtts/api/health`],
-    ).toString().trim();
+      { timeout: 5000, encoding: 'utf-8' }
-    return result === '200';
+    );
+
+    const httpCode = (result.stdout || '').trim();
+    return result.status === 0 && httpCode === '200';
   } catch {
     return false;
   }