🛡️ Sentinel: Fix password truncation and command injection risks #19
Conversation
This commit addresses several security and functional issues in `copyables/entrypoint.sh`: - **Password Truncation:** Quoted `$username` and `$password` variables when calling `adduser`. Previously, passwords with spaces were truncated due to shell word splitting. - **Command Injection/Globbing:** Added `set -f` (disable globbing) around dynamic command execution for `VPNCMD_SERVER` and `VPNCMD_HUB`. This prevents accidental or malicious file path expansion if arguments contain glob characters like `*`. - **Command Loop Fix:** Fixed logic that silently ignored multiple semicolon-separated commands in `VPNCMD_*` variables. Now correctly iterates over the array to execute all provided commands. Added `tests/verify_password_fix.sh` to verify these fixes and prevent regression. Added `.jules/sentinel.md` to document the security learning.
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
|
Important Review skippedBot user detected. To trigger a single review, invoke the You can disable this status message by setting the Comment |
Identified and fixed security vulnerabilities in
copyables/entrypoint.shrelated to shell variable expansion.Vulnerabilities Fixed:
adduserfunction.VPNCMD_SERVERandVPNCMD_HUBprocessing used unquoted variable expansion that was vulnerable to file globbing (e.g.,*expanding to filenames).VPNCMD_*commands was broken, executing only the first command and ignoring the rest.Changes:
addusercalls.VPNCMD_*loops to iterate correctly over arrays.set -fto safely disable globbing during command execution.tests/verify_password_fix.sh..jules/sentinel.md.PR created automatically by Jules for task 14943116262787866956 started by @bluPhy