🛡️ Sentinel: [CRITICAL] Fix command injection via execSync#82
🛡️ Sentinel: [CRITICAL] Fix command injection via execSync#82
Conversation
… extension * Replaced `execSync` with `execFileSync` in `execSpecguard` to execute the CLI safely. * Refactored `findSpecguard` to accurately resolve `.cmd` executables on Windows environments for seamless usage with `execFileSync`. * Changed arguments to be passed as an array rather than concatenated strings to avoid shell parsing risks, fully preventing command injection vectors. * Made `activate` async (harmless change). * Adjusted error handling to pull standard out from buffered pipe responses directly. Co-authored-by: raccioly <63126795+raccioly@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
1 participant
🚨 Severity: CRITICAL
💡 Vulnerability: Command injection via
execSyncinvscode-extension/extension.js. The extension utilizedexecSync(cmd)wherecmdwas a shell-interpreted string concatenating the local binary path (localBin) with dynamic parameters. If the workspace path contained shell metacharacters (e.g.;,&,||), these would be executed.🎯 Impact: Remote Code Execution (RCE) / Local arbitrary command execution on the user's system triggered just by opening a malicious repository path.
🔧 Fix: Upgraded
execSynctoexecFileSync, bypassing the system shell entirely. Arguments are now strictly passed as separated array values. Additionally enhanced the Windows execution compat by resolvingspecguard.cmd.✅ Verification: Ran
pnpm testsuccessfully and validated the syntax compilation check withnode -c vscode-extension/extension.js.PR created automatically by Jules for task 10183714586586137549 started by @raccioly