fix(security): replace shell command execution with direct exec calls

bin/user-config/config_datas.go

@@ -1,12 +1,11 @@
-// SPDX-FileCopyrightText: 2018 - 2022 UnionTech Software Technology Co., Ltd.
+// SPDX-FileCopyrightText: 2018 - 2026 UnionTech Software Technology Co., Ltd.
 //
 // SPDX-License-Identifier: GPL-3.0-or-later
 
 package main
 
 import (
 	"bufio"
-	"errors"
 	"fmt"
 	"os"
 	"os/exec"
@@ -203,8 +202,7 @@ func copyXDGDirConfig(home, lang string) error {
 }
 
 func changeDirOwner(user, dir string) error {
-	cmd := fmt.Sprintf("chown -hR %s:%s %s", user, user, dir)
-	return doAction(cmd)
+	return exec.Command("chown", "-hR", user+":"+user, dir).Run()
 }
 
 func getDefaultLang() string {
@@ -233,12 +231,3 @@ func getDefaultLang() string {
 
 	return strings.Split(locale, ".")[0]
 }
-
-func doAction(cmd string) error {
-	out, err := exec.Command("/bin/sh", "-c", cmd).CombinedOutput()
-	if err != nil {
-		return errors.New(string(out))
-	}
-
-	return nil
-}

inputdevices1/keyboard.go

@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: 2018 - 2022 UnionTech Software Technology Co., Ltd.
+// SPDX-FileCopyrightText: 2018 - 2026 UnionTech Software Technology Co., Ltd.
 //
 // SPDX-License-Identifier: GPL-3.0-or-later
 
@@ -9,6 +9,7 @@ import (
 	"errors"
 	"fmt"
 	"os"
+	"os/exec"
 	"os/user"
 	"path"
 	"regexp"
@@ -306,17 +307,17 @@ func (kbd *Keyboard) applyOptions() {
 	}
 
 	// the old value wouldn't be cleared, so we will force clear it.
-	err := doAction(cmdSetKbd + " -option")
+	err := exec.Command(cmdSetKbd, "-option").Run()
 	if err != nil {
 		logger.Warning("failed to clear keymap option:", err)
 		return
 	}
 
-	cmd := cmdSetKbd
+	args := []string{}
 	for _, opt := range options {
-		cmd += fmt.Sprintf(" -option %q", opt)
+		args = append(args, "-option", opt)
 	}
-	err = doAction(cmd)
+	err = exec.Command(cmdSetKbd, args...).Run()
 	if err != nil {
 		logger.Warning("failed to set keymap options:", err)
 	}
@@ -555,9 +556,8 @@ func applyLayout(value string) error {
 		}
 	}
 
-	var cmd = fmt.Sprintf("%s -layout \"%s\" -variant \"%s\"",
-		cmdSetKbd, layout, variant)
-	return doAction(cmd)
+	var cmd = exec.Command(cmdSetKbd, "-layout", layout, "-variant", variant)
+	return cmd.Run()
 }
 
 func setQtCursorBlink(rate int32, file string) error {
@@ -621,15 +621,15 @@ func getValueFromLine(line, delim string) string {
 }
 
 func applyXmodmapConfig() error {
-	err := doAction("xmodmap -e 'keycode 247 = XF86Away NoSymbol NoSymbol'")
+	err := exec.Command("xmodmap", "-e", "keycode 247 = XF86Away NoSymbol NoSymbol").Run()
 	if err != nil {
 		return err
 	}
 	config := os.Getenv("HOME") + "/.Xmodmap"
 	if !dutils.IsFileExist(config) {
 		return nil
 	}
-	return doAction("xmodmap " + config)
+	return exec.Command("xmodmap", config).Run()
 }
 
 func (kbd *Keyboard) listenRootWindowXEvent() {

inputdevices1/utils.go

@@ -1,13 +1,10 @@
-// SPDX-FileCopyrightText: 2018 - 2022 UnionTech Software Technology Co., Ltd.
+// SPDX-FileCopyrightText: 2018 - 2026 UnionTech Software Technology Co., Ltd.
 //
 // SPDX-License-Identifier: GPL-3.0-or-later
 
 package inputdevices
 
 import (
-	"errors"
-	"os/exec"
-
 	"github.com/linuxdeepin/dde-daemon/common/dconfig"
 )
 
@@ -145,11 +142,3 @@ func isItemInList(item string, list []string) bool {
 	}
 	return false
 }
-
-func doAction(cmd string) error {
-	out, err := exec.Command("/bin/sh", "-c", cmd).CombinedOutput()
-	if err != nil {
-		return errors.New(string(out))
-	}
-	return nil
-}

keybinding1/manager.go

@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: 2018 - 2022 UnionTech Software Technology Co., Ltd.
+// SPDX-FileCopyrightText: 2018 - 2026 UnionTech Software Technology Co., Ltd.
 //
 // SPDX-License-Identifier: GPL-3.0-or-later
 
@@ -10,6 +10,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"regexp"
 
 	"github.com/linuxdeepin/go-lib/appinfo/desktopappinfo"
 	"github.com/linuxdeepin/go-lib/strv"
@@ -1290,22 +1291,14 @@ func (m *Manager) listenSystemPlatformChanged() {
 	})
 }
 
-func runCommand(cmd string) (string, error) {
-	result, err := exec.Command("/bin/sh", "-c", cmd).Output()
-	if err != nil {
-		return "", err
-	}
-	return strings.TrimSpace(string(result)), err
-}
-
 func checkProRunning(serverName string) bool {
-	cmd := `ps ux | awk '/` + serverName + `/ && !/awk/ {print $2}'`
-	pid, err := runCommand(cmd)
-	if err != nil {
-		logger.Warning(err)
+	// Validate serverName to prevent command injection
+	if !regexp.MustCompile(`^[a-zA-Z0-9._@:/-]+$`).MatchString(serverName) {
+		logger.Warningf("invalid server name: %s", serverName)
 		return false
 	}
-	return pid != ""
+	err := exec.Command("pgrep", "-f", serverName).Run()
+	return err == nil
 }
 
 func (m *Manager) execCmd(cmd string, viaStartdde bool) error {

system/inputdevices1/inputdevices.go

@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: 2018 - 2022 UnionTech Software Technology Co., Ltd.
+// SPDX-FileCopyrightText: 2018 - 2026 UnionTech Software Technology Co., Ltd.
 //
 // SPDX-License-Identifier: GPL-3.0-or-later
 
@@ -8,7 +8,6 @@ import (
 	"errors"
 	"fmt"
 	"os"
-	"os/exec"
 	"regexp"
 	"strconv"
 	"strings"
@@ -633,11 +632,5 @@ func setSupportAcpiDeviceEnable(devicePath string) error {
 		return err
 	}
 	logger.Infof("paths[0] %s,paths[1] %s", paths[0], paths[1])
-
-	cmd := exec.Command("/bin/sh", "-c", "echo "+paths[1]+"> "+paths[0])
-	err := cmd.Run()
-	if err != nil {
-		return err
-	}
-	return nil
+	return os.WriteFile(paths[0], []byte(paths[1]+"\n"), 0644)
 }

systeminfo1/lsblk_disk.go

@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: 2022 UnionTech Software Technology Co., Ltd.
+// SPDX-FileCopyrightText: 2022 - 2026 UnionTech Software Technology Co., Ltd.
 //
 // SPDX-License-Identifier: GPL-3.0-or-later
 
@@ -150,6 +150,5 @@ func parseLsblkOutput(out []byte) (*lsblkOutput, error) {
 }
 
 func execLsblk() ([]byte, error) {
-	lsblk := "lsblk -J -bno NAME,SERIAL,TYPE,SIZE,VENDOR,MODEL,MOUNTPOINT,UUID"
-	return exec.Command("/bin/sh", "-c", lsblk).CombinedOutput()
+	return exec.Command("lsblk", "-J", "-bno", "NAME,SERIAL,TYPE,SIZE,VENDOR,MODEL,MOUNTPOINT,UUID").CombinedOutput()
 }