From c4f7ad28134f44fd10d79e98bd89da64a6b51693 Mon Sep 17 00:00:00 2001 From: seonghobae <8172694+seonghobae@users.noreply.github.com> Date: Mon, 13 Jul 2026 21:57:12 +0000 Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[CRITICAL/H?= =?UTF-8?q?IGH]=20=EC=BB=A4=EB=A7=A8=EB=93=9C=20=EC=9D=B8=EC=A0=9D?= =?UTF-8?q?=EC=85=98=20=EC=B7=A8=EC=95=BD=EC=A0=90=20=EC=88=98=EC=A0=95=20?= =?UTF-8?q?(=EB=B3=B4=EC=95=88=20=EA=B7=B9=EC=9E=A5=20=EC=9A=B0=ED=9A=8C?= =?UTF-8?q?=20=EB=B0=A9=EC=A7=80)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - `scripts/ci/sandboxed_web_e2e.py`에 존재하던 셸 명령어 주입 취약점 조치 - `/bin/bash -lc` 래퍼를 통한 실행을 우회하지 않도록, `shlex.split()`를 사용하여 안전한 인자 리스트로 전환 - 관련된 테스트 수정 및 `.jules/sentinel.md` 저널 항목 업데이트 - 테스트 커버리지 유지 (100%) --- .jules/sentinel.md | 4 ++++ scripts/ci/sandboxed_web_e2e.py | 5 +++-- tests/test_sandboxed_web_e2e.py | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.jules/sentinel.md b/.jules/sentinel.md index bd6868c2a..be2dfa4bb 100644 --- a/.jules/sentinel.md +++ b/.jules/sentinel.md @@ -31,3 +31,7 @@ **Vulnerability:** Initial URL validation for SSRF (e.g., checking scheme and IP address) is insufficient if the HTTP client automatically follows redirects. In `urllib.request.urlopen`, redirects are followed by default, allowing an attacker to bypass initial checks by returning a 302 redirect to an internal IP (like `169.254.169.254` or `127.0.0.1`). **Learning:** `urllib.request.urlopen` does not inherit the security properties of the initial URL string check. It will follow HTTP redirects unconditionally to any target URL, creating a severe SSRF risk when dealing with external API endpoints that can be manipulated by malicious responses. **Prevention:** Explicitly disable redirects by subclassing `urllib.request.HTTPRedirectHandler`, overriding `redirect_request` to raise an `urllib.error.HTTPError`, and using `urllib.request.build_opener(NoRedirectHandler())` instead of the default `urlopen`. +## 2026-07-13 - Complete the Fix for Command Injection Security Theater +**Vulnerability:** Command Injection +**Learning:** Fixing a `shell=True` vulnerability by replacing it with `shell=False` and wrapping the command string in `["/bin/bash", "-lc", command]` is incomplete and still leaves the code vulnerable to shell injection. It acts as security theater, as it misleads linters while executing untrusted input via the bash wrapper. The vulnerability was still present in `sandboxed_web_e2e.py`. +**Prevention:** Remove `/bin/bash` wrapper from `subprocess` calls in CI scripts. Always use `shlex.split(command)` to safely parse strings into a list of arguments and pass the list directly to `subprocess.Popen` or `subprocess.run`. diff --git a/scripts/ci/sandboxed_web_e2e.py b/scripts/ci/sandboxed_web_e2e.py index 506cc044b..ae0c3105a 100644 --- a/scripts/ci/sandboxed_web_e2e.py +++ b/scripts/ci/sandboxed_web_e2e.py @@ -7,6 +7,7 @@ import os import signal import shutil +import shlex import subprocess import sys import tempfile @@ -102,7 +103,7 @@ def start_service(label: str, command: str, cwd: Path, env: dict[str, str], logs log_path = logs_dir / f"{label}.log" log_file = log_path.open("w", encoding="utf-8") process = subprocess.Popen( - ["/bin/bash", "-lc", command], + shlex.split(command), cwd=cwd, env=env, text=True, @@ -137,7 +138,7 @@ def wait_for_url(url: str, timeout: int, service: Service) -> bool: def run_shell(command: str, cwd: Path, env: dict[str, str], timeout: int) -> subprocess.CompletedProcess[str]: """Run a shell command and capture its output.""" return subprocess.run( - ["/bin/bash", "-lc", command], + shlex.split(command), cwd=cwd, env=env, text=True, diff --git a/tests/test_sandboxed_web_e2e.py b/tests/test_sandboxed_web_e2e.py index 7bd9a2a81..6e092c293 100644 --- a/tests/test_sandboxed_web_e2e.py +++ b/tests/test_sandboxed_web_e2e.py @@ -180,12 +180,12 @@ def fake_run(*args, **kwargs): assert service.label == "backend" assert service.command == "npm run dev" assert service.log_path == tmp_path / "backend.log" - assert popen_calls[0][0] == (["/bin/bash", "-lc", "npm run dev"],) + assert popen_calls[0][0] == (["npm", "run", "dev"],) assert "shell" not in popen_calls[0][1] assert "executable" not in popen_calls[0][1] assert popen_calls[0][1]["start_new_session"] is True assert completed.returncode == 7 - assert run_calls[0][0] == (["/bin/bash", "-lc", "npm test"],) + assert run_calls[0][0] == (["npm", "test"],) assert run_calls[0][1]["timeout"] == 5 assert "shell" not in run_calls[0][1] assert "executable" not in run_calls[0][1]