Skip to content

🛡️ Sentinel: [CRITICAL] Fix command injection vulnerability #66

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Donach wants to merge 1 commit into
base: cfx/android-hermes-client
Choose a base branch
from
Open

🛡️ Sentinel: [CRITICAL] Fix command injection vulnerability #66

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions .jules/sentinel.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,3 +7,8 @@
**Vulnerability:** The daemon configuration file (`~/.agor/config.yaml`) and its parent directory (`~/.agor`) were created with default file permissions (e.g., `0o755`/`0o644`), which made them readable by other users on the system. This file stores extremely sensitive information such as API keys and master JWT secrets.
**Learning:** Default Node.js filesystem operations (`fs.writeFile` and `fs.mkdir`) do not enforce strict permissions unless explicitly specified with a `mode` parameter. When handling sensitive files, relying on the system `umask` is insufficient.
**Prevention:** Always specify `mode: 0o600` for sensitive files and `mode: 0o700` for their parent directories. Additionally, use `fs.chmod` to retroactively secure existing files and directories that might have been created with permissive defaults.

## $(date +%Y-%m-%d) - Command Injection in Unix Integration and Executions
**Vulnerability:** Command Injection via \`execSync\` due to unsanitized inputs embedded inside string execution commands.
**Learning:** Functions like \`execSync(command)\` use the shell to evaluate strings before passing them to the operating system, making it prone to variable expansions causing unintended command execution.
**Prevention:** Use \`execFileSync(command, args)\` to explicitly separate the program from its parameters, which bypasses the shell entirely. Use \`--\` before arguments to prevent flag injections.
6 changes: 3 additions & 3 deletions apps/agor-daemon/src/services/terminals.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@
* - xterm.js frontend for rendering
*/

import { execSync } from 'node:child_process';
import { execFileSync } from 'node:child_process';
import fs from 'node:fs';
import os from 'node:os';
import path from 'node:path';
Expand Down Expand Up @@ -51,7 +51,7 @@ interface CreateTerminalData {
*/
function isZellijAvailable(): boolean {
try {
execSync('which zellij', { stdio: 'pipe', timeout: 2000 });
execFileSync('which', ['zellij'], { stdio: 'pipe', timeout: 2000 });
return true;
} catch {
return false;
Expand Down Expand Up @@ -109,7 +109,7 @@ ${exportLines.join('\n')}
try {
// CRITICAL: Use -n flag to prevent password prompts that freeze the system
// Also add timeout to prevent any hangs
execSync(`sudo -n chown "${chownTo}" "${envFile}"`, { stdio: 'pipe', timeout: 2000 });
execFileSync('sudo', ['-n', 'chown', '--', chownTo, envFile], { stdio: 'pipe', timeout: 2000 });
} catch (chownError) {
console.warn(`Failed to chown env file to ${chownTo}:`, chownError);
// Continue anyway - file may still be readable in some configurations
Expand Down
10 changes: 5 additions & 5 deletions packages/core/src/unix/id-lookups.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
* Supports both Linux (using getent) and macOS (parsing /etc/group and /etc/passwd)
*/

import { execSync } from 'node:child_process';
import { execFileSync } from 'node:child_process';
import fs from 'node:fs';

/**
Expand All @@ -26,7 +26,7 @@ export function getGidFromGroupName(groupName: string | undefined | null): numbe
try {
// Try getent first (Linux, some BSD)
try {
const result = execSync(`getent group "${groupName}"`, {
const result = execFileSync('getent', ['group', '--', groupName], {
encoding: 'utf-8',
stdio: 'pipe',
timeout: 2000,
Expand Down Expand Up @@ -91,7 +91,7 @@ export function getUidFromUsername(username: string | undefined | null): number
try {
// Try `id -u username` first (most reliable)
try {
const result = execSync(`id -u "${username}"`, {
const result = execFileSync('id', ['-u', '--', username], {
encoding: 'utf-8',
stdio: 'pipe',
timeout: 2000,
Expand All @@ -107,7 +107,7 @@ export function getUidFromUsername(username: string | undefined | null): number

// Try getent (Linux, some BSD)
try {
const result = execSync(`getent passwd "${username}"`, {
const result = execFileSync('getent', ['passwd', '--', username], {
encoding: 'utf-8',
stdio: 'pipe',
timeout: 2000,
Expand Down Expand Up @@ -171,7 +171,7 @@ export function getHomedirFromUsername(username: string | undefined | null): str
try {
// Try getent first (Linux, some BSD)
try {
const result = execSync(`getent passwd "${username}"`, {
const result = execFileSync('getent', ['passwd', '--', username], {
encoding: 'utf-8',
stdio: 'pipe',
timeout: 2000,
Expand Down