Repository navigation
Hardening: use execFileSync argv form in scanner + add CI - #1
Merged
Merged
Conversation
Convert the string-mode execSync calls in scan.mjs to execFileSync argv
form to eliminate shell interpolation on a machine scanner (defense in
depth). The `lsof ... -p ${pids}` call previously interpolated a
comma-joined pid list into a shell string; pids is now passed as a
discrete argv argument. The constant git/launchctl/ps/lsof calls are
converted for consistency. Shell `2>/dev/null` redirection is replaced
by stdio: ['ignore','pipe','ignore'] to suppress stderr identically.
Output parsing is unchanged.
Also add a Node CI workflow (build + test + npm audit + gitleaks).
Claude-Session: https://claude.ai/code/session_01BAMbBXXNhnUcztWtqTHzmu
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Vulnerability (LOW — defense-in-depth)
scan.mjsused string-modeexecSyncwith shell interpolation for several system-inspection commands, most notably:pidsis built fromNumber()-parsed listening PIDs, so it's digits-only and not currently exploitable. But string-modeexecSyncon a machine scanner is a smell: it invokes a shell and would be injection-prone if any interpolated input ever became attacker-influenced.Fix
execFileSync(cmd, [args...])argv form (no shell), importingexecFileSyncfromnode:child_process.lsof ... -p ${pids}call now passes pids as a discrete argv argument (['-a','-d','cwd','-p', pids]).git remote get-url origin,launchctl list,ps -axww -o pid=,command=,lsof -nP -iTCP -sTCP:LISTEN) to argv form too for consistency.2>/dev/nullredirection is replaced bystdio: ['ignore','pipe','ignore']to suppress stderr identically. Output parsing is unchanged.CI
Added
.github/workflows/ci.yml(the repo had no CI): Node build + test, plusnpm audit(high) and a gitleaks secret scan.Verification
node --check scan.mjspasses.npm run buildpasses.npm test— 18/18 pass.🤖 Generated with Claude Code
https://claude.ai/code/session_01BAMbBXXNhnUcztWtqTHzmu