Skip to content

🛡️ Sentinel: [CRITICAL] Fix command injection in id-lookups #50

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Donach wants to merge 1 commit into
base: cfx/android-hermes-client
Choose a base branch
from
Open

🛡️ Sentinel: [CRITICAL] Fix command injection in id-lookups #50

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions .jules/sentinel.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,3 +7,7 @@
**Vulnerability:** The daemon configuration file (`~/.agor/config.yaml`) and its parent directory (`~/.agor`) were created with default file permissions (e.g., `0o755`/`0o644`), which made them readable by other users on the system. This file stores extremely sensitive information such as API keys and master JWT secrets.
**Learning:** Default Node.js filesystem operations (`fs.writeFile` and `fs.mkdir`) do not enforce strict permissions unless explicitly specified with a `mode` parameter. When handling sensitive files, relying on the system `umask` is insufficient.
**Prevention:** Always specify `mode: 0o600` for sensitive files and `mode: 0o700` for their parent directories. Additionally, use `fs.chmod` to retroactively secure existing files and directories that might have been created with permissive defaults.
## 2025-05-19 - [Command Injection Risk via execSync String Interpolation]
**Vulnerability:** A Command Injection vulnerability existed in `packages/core/src/unix/id-lookups.ts` where unvalidated user inputs (`username` and `groupName`) were interpolated directly into shell strings via `execSync` (e.g., `execSync(\`id -u "\${username}"\`)`).
**Learning:** Using `execSync` with template literals exposes the application to command injection because the input is evaluated by a shell (`/bin/sh`). Additionally, inputs starting with `-` could be executed as unintended flags (Argument Injection), and non-string inputs could cause runtime TypeErrors in stricter functions like `execFileSync`.
**Prevention:** Use `execFileSync` instead of `execSync` to bypass shell evaluation completely, explicitly cast dynamic inputs to strings (e.g., `String(username)`), and include `--` in the arguments array to denote the end of command options (e.g., `execFileSync('id', ['-u', '--', String(username)])`).
13 changes: 8 additions & 5 deletions packages/core/src/unix/id-lookups.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
* Supports both Linux (using getent) and macOS (parsing /etc/group and /etc/passwd)
*/

import { execSync } from 'node:child_process';
import { execFileSync } from 'node:child_process';
import fs from 'node:fs';

/**
Expand All @@ -22,11 +22,12 @@ export function getGidFromGroupName(groupName: string | undefined | null): numbe
if (!groupName) {
return undefined;
}
const groupNameStr = String(groupName);

try {
// Try getent first (Linux, some BSD)
try {
const result = execSync(`getent group "${groupName}"`, {
const result = execFileSync('getent', ['group', '--', groupNameStr], {
encoding: 'utf-8',
stdio: 'pipe',
timeout: 2000,
Expand Down Expand Up @@ -87,11 +88,12 @@ export function getUidFromUsername(username: string | undefined | null): number
if (!username) {
return undefined;
}
const usernameStr = String(username);

try {
// Try `id -u username` first (most reliable)
try {
const result = execSync(`id -u "${username}"`, {
const result = execFileSync('id', ['-u', '--', usernameStr], {
encoding: 'utf-8',
stdio: 'pipe',
timeout: 2000,
Expand All @@ -107,7 +109,7 @@ export function getUidFromUsername(username: string | undefined | null): number

// Try getent (Linux, some BSD)
try {
const result = execSync(`getent passwd "${username}"`, {
const result = execFileSync('getent', ['passwd', '--', usernameStr], {
encoding: 'utf-8',
stdio: 'pipe',
timeout: 2000,
Expand Down Expand Up @@ -167,11 +169,12 @@ export function getHomedirFromUsername(username: string | undefined | null): str
if (!username) {
return undefined;
}
const usernameStr = String(username);

try {
// Try getent first (Linux, some BSD)
try {
const result = execSync(`getent passwd "${username}"`, {
const result = execFileSync('getent', ['passwd', '--', usernameStr], {
encoding: 'utf-8',
stdio: 'pipe',
timeout: 2000,
Expand Down