fix: unsafe shell command constructed from library input #2455
Conversation
|
@odaysec It seems you are creating pull requests across multiple GitHub repositories, potentially based on detecting specific patterns in source code automatically. Unfortunately, it also seems that you are not taking into account the circumstances under which the code in question runs, and what its intended behavior would be. I will close this PR and #2454 as they do not appear to be targeting legitimate vulnerabilities in this software. For the future, please be encouraged to bring up genuine security issues, but be advised that opening PRs across a broad set of repositories automatically without understanding the target source code will generally not help your reputation as a security researcher, and rather will put your PRs at risk of being marked as spam and reported to GitHub. |
|
Things like this make legitimate security researchers look bad. It's a shame. |
mongosh/packages/editor/src/editor.ts
Lines 243 to 246 in e9bfb2b
fix the issue should avoid using
shell: trueand instead pass the command and its arguments as an array to thespawnfunction. This ensures that the arguments are not interpreted by the shell, mitigating the risk of shell injection. Specifically:spawncall with a version that does not useshell: true.spawn.This approach ensures that the command is executed directly without shell interpretation, making it safe from injection attacks.