// Line 32-36: No validation for tail and since parameters
const tail = url.searchParams.get("tail");
const since = url.searchParams.get("since");

// Line 114-122: Direct concatenation into shell command
const baseCommand = `docker container logs --timestamps --tail ${tail} --since ${since} --follow ${containerId}`;

// Line 123: Executed via shell
const ptyProcess = spawn(shell, ["-c", command], {...});

// Add validation functions
const isValidTail = (tail: string): boolean => {
    return /^\d+$/.test(tail) && parseInt(tail) <= 10000;
};

const isValidSince = (since: string): boolean => {
    return since === "all" || /^\d+[smhd]$/.test(since);
};

// Apply validation
wssTerm.on("connection", async (ws, req) => {
    const containerId = url.searchParams.get("containerId");
    const tail = url.searchParams.get("tail") || "100";
    const since = url.searchParams.get("since") || "all";

    if (!containerId || !isValidContainerId(containerId)) {
        ws.close(4000, "Invalid container ID");
        return;
    }

    if (!isValidTail(tail)) {
        ws.close(4000, "Invalid tail parameter");
        return;
    }

    if (!isValidSince(since)) {
        ws.close(4000, "Invalid since parameter");
        return;
    }

    // Use parameter array instead of string concatenation
    const args = ["container", "logs", "--timestamps", "--tail", tail];
    if (since !== "all") args.push("--since", since);
    args.push("--follow", containerId);

    const ptyProcess = spawn("docker", args, {...});
});