aunubaileys 1.0.42 → 1.0.43

package/README.md

@@ -64,6 +64,10 @@ Everything else is pure upstream. When upstream moves, we rebase the patch layer
 
 
 
+### 🆕 What's new in 1.0.43 / Baru di 1.0.43
+
+- 🎬 **Video thumbnails now invoke FFmpeg via `spawn` with an argument array** instead of a shell-executed command string (`exec`). `extractVideoThumb` builds the invocation as data rather than shell text, so a file path can no longer smuggle shell commands into it; the function signature and behaviour are unchanged (file output, same caller in `generateThumbnail`). The pattern follows @itsliaaa/baileys; their pipe-to-buffer redesign was **not** adopted because it would change this function's public behaviour.
+
 ### 🆕 What's new in 1.0.42 / Baru di 1.0.42
 
 - 🧑‍💻 **Full rich responses: highlighted code blocks + tables** — completing the simple `aiRich` branch that has existed since the 1.0.2–1.0.4 era. Send `{ code, language }`, `{ table, title }`, `{ links }`, or prebuilt `{ richResponse }` submessages and the message routes to the new rich response builder (`lib/Utils/rich-message-utils.js`, exported: `tokenizeCode`, `prepareRichResponseMessage`, `toUnified`): code is tokenized per language (keyword tables for 12 languages + a lexer) into highlight blocks, tables become header + body rows, and the `unifiedResponse` rendering payload is assembled automatically. Two adaptations from the source (@itsliaaa/baileys), recorded plainly: **(1)** the source's donation-link fallbacks are removed — a link without a `url` is skipped and no third-party label/URL is ever injected; **(2)** the 6.7.24 proto has **no** `botForwardedMessage` field and no `BotMetadata.verificationMetadata`/`botResponseId`, so on this base the rich response is sent as the Message's own `richResponseMessage` field (the same shape as the existing `aiRich` branch) and the v7 bot-proof apparatus is not fabricated; the enums follow this proto's nested layout.

package/lib/Utils/messages-media.js

@@ -1,6 +1,6 @@
 import { Boom } from '@hapi/boom';
 import axios, {} from 'axios';
-import { exec } from 'child_process';
+import { spawn } from 'child_process';
 import * as Crypto from 'crypto';
 import { once } from 'events';
 import { createReadStream, createWriteStream, promises as fs, WriteStream } from 'fs';
@@ -85,13 +85,26 @@ export async function getMediaKeys(buffer, mediaType) {
 }
 /** Extracts video thumb using FFMPEG */
 const extractVideoThumb = async (path, destPath, time, size) => new Promise((resolve, reject) => {
-    const cmd = `ffmpeg -ss ${time} -i ${path} -y -vf scale=${size.width}:-1 -vframes 1 -f image2 ${destPath}`;
-    exec(cmd, err => {
-        if (err) {
-            reject(err);
+    // AunuBaileys: spawn dengan array argumen, tanpa shell (dari @itsliaaa/baileys) —
+    // path/waktu/ukuran tidak lagi diinterpolasi ke string perintah shell
+    const ffmpeg = spawn('ffmpeg', [
+        '-ss', String(time),
+        '-i', path,
+        '-y',
+        '-vf', `scale=${size.width}:-1`,
+        '-vframes', '1',
+        '-f', 'image2',
+        destPath
+    ], { stdio: ['ignore', 'ignore', 'pipe'] });
+    const stderrChunks = [];
+    ffmpeg.stderr.on('data', (chunk) => stderrChunks.push(chunk));
+    ffmpeg.on('error', reject);
+    ffmpeg.on('close', (code) => {
+        if (code === 0) {
+            resolve();
         }
         else {
-            resolve();
+            reject(new Error(`ffmpeg exited with code ${code}: ${Buffer.concat(stderrChunks).toString('utf8').trim()}`));
         }
     });
 });

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "aunubaileys",
   "type": "module",
-  "version": "1.0.42",
+  "version": "1.0.43",
   "description": "AunuBaileys \u2014 a WhatsApp Web API for bots that never sleep. Full upstream power with the beloved in-memory store restored and pairing that just works. Forged by AunuCore.",
   "keywords": [
     "whatsapp",