From fe5834b6a034222c89ac3501fe55deee29ffcd30 Mon Sep 17 00:00:00 2001 From: Cylae <13425054+Cylae@users.noreply.github.com> Date: Wed, 9 Sep 2026 01:02:19 +0000 Subject: [PATCH] =?UTF-8?q?=F0=9F=94=92=20Fix=20Command=20Execution=20with?= =?UTF-8?q?=20relative=20useradd=20path?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Replace Command::new("useradd") with absolute path Command::new("/usr/sbin/useradd") in server_manager/src/core/system.rs to eliminate risk of binary hijacking via PATH manipulation. Added unit test suite for username input validation. --- server_manager/src/core/system.rs | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/server_manager/src/core/system.rs b/server_manager/src/core/system.rs index d3ef19f..cca4d9e 100644 --- a/server_manager/src/core/system.rs +++ b/server_manager/src/core/system.rs @@ -106,7 +106,7 @@ pub fn create_system_user(username: &str, password: &str) -> Result<()> { info!("Creating system user '{}'...", username); // useradd -m -s /bin/bash - let status = Command::new("useradd") + let status = Command::new("/usr/sbin/useradd") .arg("-m") .arg("-s") .arg("/bin/bash") @@ -309,3 +309,17 @@ net.core.wmem_max=1048576 Ok(()) } + +#[cfg(test)] +mod tests { + use super::*; + + #[test] + fn test_validate_username() { + assert!(validate_username("valid_user").is_ok()); + assert!(validate_username("valid-user-123").is_ok()); + assert!(validate_username("").is_err()); + assert!(validate_username("invalid user").is_err()); + assert!(validate_username("user;id").is_err()); + } +}