golang框架如何处理命令注入？

package main

import (

    "Github.com/gin-gonic/gin"

    "os/exec"

)

func main() {

    router := gin.Default()

    router.GET("/cmd", func(c *gin.Context) {

        command := c.Query("cmd")

        // 输入验证：检查命令中是否存在特殊字符

        if strings.Contains(command, ";") || strings.Contains(command, "&") {

            c.JSON(400, gin.H{"error": "Invalid command"})

            return

        }

        // 命令构建：将命令传递给 os/exec.Command，使用分隔符转义字符进行转义

        cmd := exec.Command("sh", "-c", exec.Commandescape(command))

        //执行命令

        out, err := cmd.CombinedOutput()

        if err != nil {

            c.JSON(500, gin.H{"error": err.Error()})

            return

        }

        // 返回命令输出

        c.String(200, string(out))

    })

}