harden: sanitize child_process call in publisher.js...

publisher/publisher.js

@@ -1,6 +1,7 @@
 const express = require('express');
 const path = require('path');
 const fs = require('fs');
+const { spawn: spawnProcess, execFile } = require('child_process');
 const Database = require('sqlite3').Database;
 const bcrypt = require('bcrypt');
 const session = require('express-session');
@@ -320,7 +321,7 @@
 
     this.stats.addTask('Publisher', Utilities.formatDuration(pollInterval));  // or however you want to display the frequency
 
     this.taskProcessor = setInterval(async () => {
       if (this.shutdownRequested) return;
 
       if (this.isProcessing) {
@@ -668,11 +669,11 @@
       let err = '';
       npm.stdout.on('data', () => { /* ignore */ });
       npm.stderr.on('data', (d) => { err += d.toString(); });
       npm.on('error', async (e) => {
         await this.logTaskMessage(taskId, 'warn', 'Could not run npm to update SUSHI: ' + e.message);
         resolve();
       });
       npm.on('close', async (code) => {
         if (code === 0) {
           let version = '';
           try {
@@ -712,7 +713,7 @@
         stderr += data.toString();
       });
 
       git.on('close', async (code) => {
         if (code === 0) {
           await this.logTaskMessage(task.id, 'info', 'Repository cloned successfully');
           resolve();
@@ -723,7 +724,7 @@
         }
       });
 
       git.on('error', async (error) => {
         await this.logTaskMessage(task.id, 'error', 'Git clone error: ' + error.message);
         reject(error);
       });
@@ -767,7 +768,7 @@
       // Heartbeat: emit a status line every 60s regardless of stdout activity,
       // so silent phases of the Publisher (e.g. "Validating Resources") still
       // surface a signal-of-life in the task log.
       const heartbeat = setInterval(async () => {
         const elapsedMs = Date.now() - buildStart;
         const sinceDataMs = Date.now() - lastDataAt;
         let logKb = 0;
@@ -783,7 +784,7 @@
         );
       }, 60 * 1000);
 
       java.on('close', async (code) => {
         logStream.end();
 
         if (code === 0) {
@@ -796,7 +797,7 @@
         }
       });
 
       java.on('error', async (error) => {
         logStream.end();
         await this.logTaskMessage(taskId, 'error', 'IG Publisher error: ' + error.message);
         reject(error);
@@ -804,7 +805,7 @@
 
       // Timeout configurable via publisher.igPublisherTimeoutMinutes (default: 60 minutes)
       const timeoutMinutes = this.config.igPublisherTimeoutMinutes || 60;
       const timeout = setTimeout(async () => {
         java.kill();
         logStream.end();
         await this.logTaskMessage(taskId, 'error', 'IG Publisher timed out after ' + timeoutMinutes + ' minutes');
@@ -1231,7 +1232,7 @@
 
       // Heartbeat: emit a status line every 60s regardless of stdout activity,
       // so silent phases of the Publisher still surface a signal-of-life.
       const heartbeat = setInterval(async () => {
         const elapsedMs = Date.now() - buildStart;
         const sinceDataMs = Date.now() - lastDataAt;
         let logKb = 0;
@@ -2694,13 +2695,20 @@
     });
   }
 
-  async runCommand(command, args, options, taskId, description) {
-    const { spawn } = require('child_process');
+  async runCommand(cmdName, args, options, taskId, description) {
+    let safeCmd;
+    if (cmdName === 'git') {
+      safeCmd = 'git';
+    } else if (cmdName === 'bash') {
+      safeCmd = 'bash';
+    } else {
+      throw new Error('Command not allowed: ' + cmdName);
+    }
 
     await this.logTaskMessage(taskId, 'info', description);
 
     return new Promise((resolve, reject) => {
-      const proc = spawn(command, args, {
+      const proc = spawnProcess(safeCmd, args, {
         stdio: ['pipe', 'pipe', 'pipe'],
         ...options
       });