🔒 Fix command injection vulnerability in Windows notifications - #137
Tcode-Motion merged 1 commit into
Conversation
Modified `stdlib/src/notification.rs` to securely pass dynamic string arguments via environment variables (`$env:__TS_BODY` and `$env:__TS_TITLE`) when spawning a PowerShell script on Windows. This eliminates the need for naive string replacement escaping and directly addresses a critical command injection vulnerability. Co-authored-by: Tcode-Motion <188012755+Tcode-Motion@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
1 participant
🎯 What: Fixed a critical command injection vulnerability in the Windows implementation of the
⚠️ Risk: The previous implementation used unsafe string interpolation (
std.notification.showfunction.&format!) to inject user-provided titles and bodies directly into a-Commandargument passed to PowerShell. Although it attempted to escape single quotes, this filter is highly insufficient for a complex execution environment like PowerShell, leaving the system extremely vulnerable to arbitrary code execution by malicious users or scripts.🛡️ Solution: Modified the underlying
Command::new("powershell")execution to leverage environment variables instead of string interpolation. The title and body are securely injected as environment variables (__TS_TITLEand__TS_BODY), and the PowerShell script simply reads from them ($env:__TS_BODYand$env:__TS_TITLE). This completely mitigates command injection because the values are handled strictly as data by the OS environment rather than executable script content.PR created automatically by Jules for task 9008419798713182077 started by @Tcode-Motion