[security] Fix command injection, path traversal in installer + marketplace #6

New issue

Open

opened 2026-03-22 16:36:48 +00:00 by Virgil · 2 comments

Virgil commented

2026-03-22 16:36:48 +00:00

Member

AX sweep findings:

HIGH — Remote command injection via unsanitized agent.QueueDir in SSH command string (dispatch.go:277, :284)
HIGH — Marketplace module path traversal allows filesystem write/delete outside modules root (installer.go:55, :112)
HIGH — Plugin installer path traversal through unvalidated repo/name from source (installer.go:32, :43)
MEDIUM — Marketplace API :code path segment trusted without normalization (provider.go:246, :273)
MEDIUM — CLI sync path joins allow traversal from user-supplied repo argument (cmd_sync.go:96, :102)
LOW — Unescaped repo path in Forge PR draft URL (prs.go:47)

Fix all, add tests.

AX sweep findings: 1. HIGH — Remote command injection via unsanitized agent.QueueDir in SSH command string (dispatch.go:277, :284) 2. HIGH — Marketplace module path traversal allows filesystem write/delete outside modules root (installer.go:55, :112) 3. HIGH — Plugin installer path traversal through unvalidated repo/name from source (installer.go:32, :43) 4. MEDIUM — Marketplace API :code path segment trusted without normalization (provider.go:246, :273) 5. MEDIUM — CLI sync path joins allow traversal from user-supplied repo argument (cmd_sync.go:96, :102) 6. LOW — Unescaped repo path in Forge PR draft URL (prs.go:47) Fix all, add tests.

Virgil commented

2026-03-22 18:48:04 +00:00

Author

Member

Codex Fix Attempt

Codex ran full build/test cycle (all passed) but could not commit — sandbox blocks .git writes. The original security findings remain valid and need manual fix or re-dispatch with write access.

## Codex Fix Attempt Codex ran full build/test cycle (all passed) but could not commit — sandbox blocks .git writes. The original security findings remain valid and need manual fix or re-dispatch with write access.

Virgil commented

2026-03-23 12:04:48 +00:00

Author

Member

Security Scan: Attack Vector Map

Good news: Original SSH injection and path traversal issues appear mitigated in current worktree.

Entry	Input	Flows Into	Validation	Residual Risk
DispatchHandler.Execute (dispatch.go:81)	Forgejo issue/PR metadata + QueueDir	SSH commands, ticket JSON	SanitizePath, ValidateRemoteDir, JoinRemotePath	Prompt injection via issue title/body, shell-sink helper reuse
SetPRDraft (prs.go:42)	owner/repo	HTTP PATCH URL	ValidatePathElement + url.PathEscape	Low — mitigated unless callers bypass validation

Warning: dispatch.go:267/:281 are generic remote-shell primitives. Currently fed validated inputs but new call sites could re-open injection.

## Security Scan: Attack Vector Map **Good news**: Original SSH injection and path traversal issues appear mitigated in current worktree. | Entry | Input | Flows Into | Validation | Residual Risk | |---|---|---|---|---| | DispatchHandler.Execute (dispatch.go:81) | Forgejo issue/PR metadata + QueueDir | SSH commands, ticket JSON | SanitizePath, ValidateRemoteDir, JoinRemotePath | Prompt injection via issue title/body, shell-sink helper reuse | | SetPRDraft (prs.go:42) | owner/repo | HTTP PATCH URL | ValidatePathElement + url.PathEscape | Low — mitigated unless callers bypass validation | **Warning**: dispatch.go:267/:281 are generic remote-shell primitives. Currently fed validated inputs but new call sites could re-open injection.