Language: PHP
Label: vulnerable
CWE: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Code:
	public function videoPreview($plugin){
		$pickCount = 300;// 总共截取图片数(平均时间内截取)
		$path = $plugin->filePath($GLOBALS['in']['path']);
		$fileInfo = IO::info($path);
		$fileInfo = Action('explorer.list')->pathInfoMore($fileInfo);
		$tempFileName = 'preview-'.KodIO::hashPath($fileInfo).'.jpg';
		$findSource = IO::fileNameExist($plugin->cachePath,$tempFileName);
		if($findSource){return IO::fileOut(KodIO::make($findSource));}

		$command = $plugin->getFFmpeg();
		if(!$command){return show_json('command error',false);}
		$localFile = $plugin->localFile($path);
		if(!$localFile ){return show_json('not local file',false);}
		$videoInfo = $this->parseVideoInfo($command,$localFile);
		$this->storeVideoMetadata($fileInfo,$videoInfo);
		if(!$videoInfo || $videoInfo['playtime'] <= 30){return show_json('time too short!',false);}
		
		// $pickCount = $totalTime; 每秒生成一张图片; 可能很大
		// 宽列数固定10幅图, 行数为总截取图除一行列数; https://blog.51cto.com/u_15639793/5297432
		if(Cache::get($tempFileName)) return show_json('running');
		Cache::set($tempFileName,'running',600);
		
		ignore_timeout();
		$tempPath = TEMP_FILES.$tempFileName;
		$fps = $pickCount / $videoInfo['playtime'];
		$sizeW = 150;
		$tile  = '10x'.ceil($pickCount / 10).''; 
		$scale = 'scale='.$sizeW.':-2'; //,pad='.$sizeW.':'.$sizeH.':-1:-1 -q:v 1~5 ;质量从最好到最差;
		$args  = '-sws_flags accurate_rnd -q:v 4 -an'; //更多参数; 设置图片缩放算法(不设置缩小时可能产生绿色条纹花屏);
		$cmd = 'ffmpeg -y -i "'.$localFile.'" -vf "fps='.$fps.','.$scale.',tile='.$tile.'" '.$args.' "'.$tempPath.'"';
		$this->log('[videoPreview start] '.$fileInfo['name'].';size='.size_format($fileInfo['size']),0,0);$timeStart = timeFloat();
		$this->log('[videoPreview run] '.$cmd,0,0);
		@shell_exec($cmd);//pr($cmd);exit;
		Cache::remove($tempFileName);
		
		$success = file_exists($tempPath) && filesize($tempPath) > 100;
		$msg     = $success ? 'success' : 'error';
		$this->log('[videoPreview end] '.$fileInfo['name'].';time='.(timeFloat() - $timeStart).'s;'.$msg,0,0);