Repository navigation
fix(login): open the browser without a shell (CodeQL js/command-line-injection) - #31
Merged
Merged
Conversation
…injection) openBrowser ran `cmd /c start "" <url>` on Windows, with the URL taken from the hub's device-login response. cmd parses `&`, `|` and `^` in its arguments, so a hostile or compromised --server could run commands on the user's machine. - only http(s) URLs are opened (parsed with URL, normalised href) - Windows uses `rundll32 url.dll,FileProtocolHandler <url>`, no cmd - test/device-login.test.ts covers both Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
🎉 This PR is included in version 1.4.1 🎉 The release is available on: Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes code-scanning alert #1 (
js/command-line-injection, error) insrc/lib/device-login.ts.Problem
openBrowserrancmd /c start "" <url>on Windows. The URL isverificationUriComplete ?? verificationUrifrom the hub's/v2/auth/device/startresponse.cmdparses&,|and^in its arguments, so a hostile or compromised--servercould makenorbix loginrun arbitrary commands.Fix
http:/https:URLs are opened; anything else (file:,javascript:, bare strings) is skipped. The URL is still printed, so login works either way.rundll32 url.dll,FileProtocolHandler <url>.spawnwithout a shell passes it as one argument; nothing parses it.open/xdg-open, no shell).Tests
New
test/device-login.test.ts: scheme allow-list, and Windows command keeps&/|inside the URL argument.npm test374/374 ✓,tsc --noEmit✓.Not tested on a real Windows machine.
🤖 Generated with Claude Code