Skip to content

🛡️ Sentinel: [CRITICAL] Fix command injection in ID lookups #154

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Donach wants to merge 1 commit into
base: cfx/android-hermes-client
Choose a base branch
from
Open

🛡️ Sentinel: [CRITICAL] Fix command injection in ID lookups #154

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions .jules/sentinel.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,3 +7,8 @@
**Vulnerability:** The daemon configuration file (`~/.agor/config.yaml`) and its parent directory (`~/.agor`) were created with default file permissions (e.g., `0o755`/`0o644`), which made them readable by other users on the system. This file stores extremely sensitive information such as API keys and master JWT secrets.
**Learning:** Default Node.js filesystem operations (`fs.writeFile` and `fs.mkdir`) do not enforce strict permissions unless explicitly specified with a `mode` parameter. When handling sensitive files, relying on the system `umask` is insufficient.
**Prevention:** Always specify `mode: 0o600` for sensitive files and `mode: 0o700` for their parent directories. Additionally, use `fs.chmod` to retroactively secure existing files and directories that might have been created with permissive defaults.

## 2025-05-13 - [Command Injection Risk via execSync in ID Lookups]
**Vulnerability:** A potential command injection vulnerability in `packages/core/src/unix/id-lookups.ts`. The code used `execSync` with string interpolation (e.g., `execSync(\`getent group "${groupName}"\`)`), allowing malicious input in usernames or group names to execute arbitrary shell commands.
**Learning:** Double quotes in `execSync` do not completely protect against injection if the input contains backticks or escaped quotes.
**Prevention:** Always use `execFileSync` from `node:child_process` with explicitly parameterized arguments instead of `execSync` to prevent the shell from parsing user inputs as commands. Ensure dynamic arguments are cast to strings and preceded by `--` to stop flag parsing.
10 changes: 5 additions & 5 deletions packages/core/src/unix/id-lookups.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
* Supports both Linux (using getent) and macOS (parsing /etc/group and /etc/passwd)
*/

import { execSync } from 'node:child_process';
import { execFileSync } from 'node:child_process';
import fs from 'node:fs';

/**
Expand All @@ -26,7 +26,7 @@ export function getGidFromGroupName(groupName: string | undefined | null): numbe
try {
// Try getent first (Linux, some BSD)
try {
const result = execSync(`getent group "${groupName}"`, {
const result = execFileSync('getent', ['group', '--', String(groupName)], {
encoding: 'utf-8',
stdio: 'pipe',
timeout: 2000,
Expand Down Expand Up @@ -91,7 +91,7 @@ export function getUidFromUsername(username: string | undefined | null): number
try {
// Try `id -u username` first (most reliable)
try {
const result = execSync(`id -u "${username}"`, {
const result = execFileSync('id', ['-u', '--', String(username)], {
encoding: 'utf-8',
stdio: 'pipe',
timeout: 2000,
Expand All @@ -107,7 +107,7 @@ export function getUidFromUsername(username: string | undefined | null): number

// Try getent (Linux, some BSD)
try {
const result = execSync(`getent passwd "${username}"`, {
const result = execFileSync('getent', ['passwd', '--', String(username)], {
encoding: 'utf-8',
stdio: 'pipe',
timeout: 2000,
Expand Down Expand Up @@ -171,7 +171,7 @@ export function getHomedirFromUsername(username: string | undefined | null): str
try {
// Try getent first (Linux, some BSD)
try {
const result = execSync(`getent passwd "${username}"`, {
const result = execFileSync('getent', ['passwd', '--', String(username)], {
encoding: 'utf-8',
stdio: 'pipe',
timeout: 2000,
Expand Down