🛡️ Sentinel: [CRITICAL] Fix command injection in execSync - #162
Conversation
Replaced vulnerable `execSync` calls with `execFileSync` in unix user utilities to prevent shell command injection. Pass dynamic arguments in the arguments array instead of string interpolation to completely bypass shell parsing. - Updates `packages/core/src/unix/id-lookups.ts` - Updates `packages/core/src/unix/user-manager.ts` - Updates test mocks - Logs findings in `.jules/sentinel.md`
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
1 participant
🚨 Severity: CRITICAL
💡 Vulnerability: Command injection vulnerability due to string interpolation in
execSynccommands. Shell characters (e.g. backticks or$()) injected via usernames or groupnames could execute arbitrary commands and break out of the shell context sinceexecSyncinvokes a shell to evaluate strings.🎯 Impact: Potential arbitrary code execution on the host machine.
🔧 Fix: Replaced
execSyncwithexecFileSync, passing dynamic parameters natively via an arguments array with--to avoid flag injection. This prevents a shell from ever being instantiated. Also updated relevant unit tests and test mocks.✅ Verification: Verified by running workspace tests and linters, observing
pnpm testsuccess, and ensuring no shell invocations occur withid -uandgetent.PR created automatically by Jules for task 10832966977488851707 started by @Donach