secure-code-1.js

const express = require('express');
const fs = require('fs').promises;
const axios = require('axios');

const app = express();
const port = 3000;

app.get('/request', async (req, res) => {
    const url = req.query?.url || '';

    if (url.match(new RegExp('^http(s)?:\/\/[a-zA-Z0-9]+\.voorivex\.academy$'))) {
        try {
            const response = await axios.get(url);
            if (response.data?.message == 'under-my-command') {
                res.send(await fs.readFile('/flag', 'utf-8'))
            }
        } catch (error) {
            res.status(500).json({ error: 'Error fetching data from the url' });
        }
    } else {
        res.status(400).json({ error: 'Invalid url' });
    }
});

app.listen(port, () => {
    console.log(`Server is running on port ${port}`);
});

this way you can access the flag : http://yourdomain.voorivex.academy/request?url=http://valid-domain.voorivex.academy&message=under-my-command