Language: Go
Label: vulnerable
CWE: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Code:
func SaveSettings(c *gin.Context) {
    var json struct {
        Server settings.Server `json:"server"`
        Nginx  settings.Nginx  `json:"nginx"`
        Openai settings.OpenAI `json:"openai"`
    }

    if !api.BindAndValid(c, &json) {
        return
    }

    settings.ServerSettings = json.Server
    settings.NginxSettings = json.Nginx
    settings.OpenAISettings = json.Openai

    settings.ReflectFrom()

    err := settings.Save()
    if err != nil {
        api.ErrHandler(c, err)
        return
    }

    GetSettings(c)
}