Skip to content

🛡️ Sentinel: [CRITICAL] Fix command injection in ID lookups #157

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Donach wants to merge 1 commit into
base: cfx/android-hermes-client
Choose a base branch
from
Open

🛡️ Sentinel: [CRITICAL] Fix command injection in ID lookups #157

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions .jules/sentinel.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,3 +7,8 @@
**Vulnerability:** The daemon configuration file (`~/.agor/config.yaml`) and its parent directory (`~/.agor`) were created with default file permissions (e.g., `0o755`/`0o644`), which made them readable by other users on the system. This file stores extremely sensitive information such as API keys and master JWT secrets.
**Learning:** Default Node.js filesystem operations (`fs.writeFile` and `fs.mkdir`) do not enforce strict permissions unless explicitly specified with a `mode` parameter. When handling sensitive files, relying on the system `umask` is insufficient.
**Prevention:** Always specify `mode: 0o600` for sensitive files and `mode: 0o700` for their parent directories. Additionally, use `fs.chmod` to retroactively secure existing files and directories that might have been created with permissive defaults.

## 2025-07-27 - [Command Injection Risk via execSync in ID Lookups]
**Vulnerability:** Shell command injection vulnerability in `packages/core/src/unix/id-lookups.ts` caused by passing user-controlled usernames and group names to `execSync` using string interpolation (e.g., `execSync(\`id -u "${username}"\`)`).
**Learning:** Double quotes inside `execSync` do not fully protect against shell injection if the input contains backticks, escaped quotes, or other shell metacharacters. Additionally, without the `--` separator, inputs starting with a hyphen could be treated as command flags.
**Prevention:** Always use `execFileSync` instead of `execSync` for dynamic arguments, pass arguments as an array, and use `--` to explicitly terminate options processing.
10 changes: 5 additions & 5 deletions packages/core/src/unix/id-lookups.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
* Supports both Linux (using getent) and macOS (parsing /etc/group and /etc/passwd)
*/

import { execSync } from 'node:child_process';
import { execFileSync } from 'node:child_process';
import fs from 'node:fs';

/**
Expand All @@ -26,7 +26,7 @@ export function getGidFromGroupName(groupName: string | undefined | null): numbe
try {
// Try getent first (Linux, some BSD)
try {
const result = execSync(`getent group "${groupName}"`, {
const result = execFileSync('getent', ['group', '--', String(groupName)], {
encoding: 'utf-8',
stdio: 'pipe',
timeout: 2000,
Expand Down Expand Up @@ -91,7 +91,7 @@ export function getUidFromUsername(username: string | undefined | null): number
try {
// Try `id -u username` first (most reliable)
try {
const result = execSync(`id -u "${username}"`, {
const result = execFileSync('id', ['-u', '--', String(username)], {
encoding: 'utf-8',
stdio: 'pipe',
timeout: 2000,
Expand All @@ -107,7 +107,7 @@ export function getUidFromUsername(username: string | undefined | null): number

// Try getent (Linux, some BSD)
try {
const result = execSync(`getent passwd "${username}"`, {
const result = execFileSync('getent', ['passwd', '--', String(username)], {
encoding: 'utf-8',
stdio: 'pipe',
timeout: 2000,
Expand Down Expand Up @@ -171,7 +171,7 @@ export function getHomedirFromUsername(username: string | undefined | null): str
try {
// Try getent first (Linux, some BSD)
try {
const result = execSync(`getent passwd "${username}"`, {
const result = execFileSync('getent', ['passwd', '--', String(username)], {
encoding: 'utf-8',
stdio: 'pipe',
timeout: 2000,
Expand Down