Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix vulnerability in AssemblyScript SDK install script #435

Merged
merged 3 commits into from
Oct 8, 2024

Conversation

mattjohnsonpint
Copy link
Member

@mattjohnsonpint mattjohnsonpint commented Oct 8, 2024

Fixes https://github.com/hypermodeinc/modus/security/code-scanning/1

To fix the problem, we should avoid using execSync with a concatenated command string that includes unsanitized environment variables. Instead, we can use execFileSync which accepts command arguments as an array of strings, thus avoiding the risk of command injection.

  • Replace the execSync call with execFileSync.
  • Construct the command arguments as an array, ensuring that each part of the command is a separate element in the array.
  • Import the necessary execFileSync function from the child_process module.

mattjohnsonpint and others added 2 commits October 7, 2024 17:57
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
@mattjohnsonpint mattjohnsonpint marked this pull request as ready for review October 8, 2024 01:02
@mattjohnsonpint mattjohnsonpint requested a review from a team as a code owner October 8, 2024 01:02
@mattjohnsonpint mattjohnsonpint changed the title Fix code scanning alert no. 1: Indirect uncontrolled command line Fix vulnerability in AssemblyScript SDK install script Oct 8, 2024
@mattjohnsonpint mattjohnsonpint enabled auto-merge (squash) October 8, 2024 01:04
@mattjohnsonpint mattjohnsonpint merged commit 03f5bcc into main Oct 8, 2024
70 checks passed
@mattjohnsonpint mattjohnsonpint deleted the autofix/alert-1-6ab08a35aa branch October 8, 2024 02:01
@mattjohnsonpint mattjohnsonpint added this to the v0.13.0 milestone Oct 8, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

2 participants