Security issue: shelljs

Bug and Security

Problem

Our goal is not to prevent malicious attacks but prevent user problems from normal folder naming. Please make sure the user can have spaces and $ in folder names.

There are different shells that use different escape symbols. I would like to support Windows Terminal, Powershell and (git) bash.

Notes

Escape symbols

• *nix uses \
• Windows Terminal uses ^

This almost works for *nix but not for Windows paths because the escape symbols are different:

let escapedDirname = __dirname.replace(/(["$])/g, "\\$1");
console.log(__dirname);
console.log(escapedDirname);

let cmd = `npm run --prefix "${escapedDirname}" start`;
console.log(cmd);
require("shelljs").exec(cmd);```

[nfischer]

Hi, ShellJS maintainer here. Chiming in with a couple thoughts.

I’m not sure, if shelljs will provide an update that will sanitize your input.

We’re not going to sanitize your input for this API. This is an explicit requirement for using shell.exec(). We have recommendations to help you accomplish this.

In our scenario we could get injected by the __dirname parameter to contain executable commands, but is this even possible?

I recommend you err on the side of caution. What if someone installs your project into a folder named /path/to/malicious folder name; rm -rf*/subdir/ (all of which are legal unix filename characters)? Even if you think this is a non-issue because the attacker already has control over the system, the power to mkdir shouldn’t be the power to execute arbitrary code. At the very least, you have a bug if you’re installed in a folder with a space in the name, which is a totally reasonable folder name.

[fatihi]

We just updated the description and changed the goal.