harden: sanitize child_process call in init.mjs...

[anupamme]

Summary

Harden input handling in bin/init.mjs (flagged by semgrep).

Vulnerability

Field	Value
ID	javascript.lang.security.detect-child-process.detect-child-process
Severity	HIGH
Scanner	semgrep
Rule	javascript.lang.security.detect-child-process.detect-child-process
File	bin/init.mjs:945
Assessment	Defensive hardening

Description: Detected calls to child_process from a function argument ref. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed.

Threat Model Context

This is a Node.js library - vulnerabilities affect downstream consumers who use this package.

Changes

• bin/init.mjs

Behavior Preservation

The change is scoped to 1 file on the vulnerable path; it only tightens handling of untrusted input and leaves valid inputs unaffected.

---

This patch removes an exploit primitive — a code pattern that, while not independently exploitable today, could be chained with other weaknesses by automated exploit-development tooling. Proactive removal of such primitives raises the bar against increasingly capable automated attack tools.

---

Automated security fix by OrbisAI Security

[arozumenko]

Thanks — the execSync → execFileSync swap is the right fix and I'm happy to merge it. One tightening request before it goes in:

The ref validator regex ^[a-zA-Z0-9._\-\/]+$ allows a leading dash. Since execFileSync passes argv directly to git (no shell), a ref like --upload-pack or --output would be interpreted by git as an option rather than a ref — argument injection rather than command injection. Impact is low (no shell reachable), but it's a cheap gap to close.

Two options, either is fine:

1. Reject leading dashes in the guard:

   if (!/^[a-zA-Z0-9._\/]+$/.test(ref) || ref.startsWith('-')) {

2. Or use -- end-of-options before the ref in each git invocation, e.g.:

   execFileSync('git', ['-C', dest, 'fetch', '--quiet', '--depth', '1', 'origin', '--', ref], ...)
   execFileSync('git', ['clone', '--quiet', '--depth', '1', '--branch', ref, '--', `https://github.com/${repo}`, dest], ...)

   (note --branch still consumes ref as its value, so option 1 is the cleaner guard here).

Prefer option 1 — a single ref.startsWith('-') check in the existing guard. Once that's in, LGTM.

[arozumenko]

commented

[anupamme]

Review comments addressed. Pls review.

[arozumenko]

Confirmed — commit 952bbcb closes it. The ref.startsWith('-') guard now rejects leading-dash refs (--upload-pack etc.), and the redundant \- escape cleanup is a nice touch. Argument-injection gap is closed and there's no shell on the path anymore. LGTM 👍