Merge pull request #40 from Tcode-Motion/fix-command-injection-6640346681076279577

🔒 Fix command injection vulnerability in stdlib process.spawn

Author: Tcode-Motion

Cargo.lock

@@ -36,3 +36,4 @@ uuid = { version = "1", features = ["v4"] }
 rustls = { version = "0.23", optional = true }
 tokio = { version = "1", features = ["rt", "macros", "sync", "time"], optional = true }
 hex = "0.4.3"
+shlex = "2.0.1"

stdlib/Cargo.toml

@@ -114,8 +114,25 @@ impl StdlibRegistry {
                             ))
                         }
                     };
-                    Command::new("cmd")
-                        .args(["/C", &cmd])
+
+                    let parsed = shlex::split(&cmd).ok_or_else(|| {
+                        RuntimeError::new(
+                            RuntimeErrorKind::InvalidOperation("Failed to parse command string".to_string()),
+                            None,
+                            None,
+                        )
+                    })?;
+
+                    if parsed.is_empty() {
+                         return Err(RuntimeError::new(
+                            RuntimeErrorKind::InvalidOperation("Empty command string".to_string()),
+                            None,
+                            None,
+                        ));
+                    }
+
+                    Command::new(&parsed[0])
+                        .args(&parsed[1..])
                         .spawn()
                         .map_err(|e| {
                             RuntimeError::new(

stdlib/src/process.rs

@@ -1,7 +1,7 @@
 use std::cell::RefCell;
 use std::collections::HashSet;
 use std::rc::Rc;
-use techscript_runtime::{context::Capability, value::RuntimeValue, RuntimeConfig, RuntimeContext};
+use techscript_runtime::{context::Capability, value::RuntimeValue, RuntimeConfig, RuntimeContext, error::RuntimeErrorKind};
 use techscript_stdlib::StdlibRegistry;
 
 #[test]