🛡️ Sentinel: [HIGH] Fix command injection vulnerability in tool existence check

.jules/sentinel.md

@@ -0,0 +1,4 @@
+## 2024-04-01 - Command Injection in toolExists
+**Vulnerability:** Command injection via `shell("/usr/bin/which \(tool)")` where `tool` could contain shell metacharacters.
+**Learning:** Naively interpolating dynamic variables into shell wrapper commands (`/bin/bash -c`) introduces command injection. While currently hardcoded, if `tool` was user-controlled or fetched dynamically, this would be highly exploitable.
+**Prevention:** Always use direct executable invocation via `Process()` and pass dynamic inputs explicitly in the `arguments` array instead of using string interpolation in a shell wrapper.

Sources/Cacheout/Models/CacheCategory.swift

@@ -186,8 +186,19 @@ struct CacheCategory: Identifiable, Hashable {
     }
 
     private func toolExists(_ tool: String) -> Bool {
-        let result = shell("/usr/bin/which \(tool)")
-        return result != nil && !result!.isEmpty
+        let process = Process()
+        process.executableURL = URL(fileURLWithPath: "/usr/bin/which")
+        process.arguments = [tool]
+        process.standardOutput = FileHandle.nullDevice
+        process.standardError = FileHandle.nullDevice
+
+        do {
+            try process.run()
+            process.waitUntilExit()
+            return process.terminationStatus == 0
+        } catch {
+            return false
+        }
     }
 
     private func runProbe(_ command: String) -> String? {