Security: Command injection vulnerability in package name handling

[bluet]

Problem

Package manager implementations use user-provided package names directly in exec.Command() calls without proper validation, creating potential command injection vulnerabilities.

Impact

• Command Injection: Malicious package names could execute arbitrary commands
• Security Risk: Especially dangerous when running with elevated privileges
• Input Validation: No sanitization of package names or arguments

Vulnerability Examples

// VULNERABLE: Direct use of user input
cmd := exec.Command("apt", "install", packageName)

// ATTACK: packageName = "vim; rm -rf /"
// Results in: apt install vim; rm -rf /

Current Risk Assessment

High Risk Scenarios:

1. Web applications using syspkg with user-provided package names
2. CLI tools running with sudo/root privileges
3. Automated systems processing untrusted input

Required Security Fixes

1. Input Validation

func validatePackageName(name string) error {
    // Check for shell metacharacters
    if strings.ContainsAny(name, ";& < /dev/null | `$(){}[]<>") {
        return fmt.Errorf("invalid package name: contains shell metacharacters")
    }
    
    // Check for valid package name format
    matched, _ := regexp.MatchString(`^[a-zA-Z0-9][a-zA-Z0-9._+-]*$`, name)
    if !matched {
        return fmt.Errorf("invalid package name format")
    }
    
    return nil
}

2. Secure Command Construction

// SECURE: Each argument is properly separated
cmd := exec.Command("apt", "install")
cmd.Args = append(cmd.Args, validatedPackageNames...)

Files Requiring Security Fixes

All package manager implementations:

• manager/apt/apt.go
• manager/yum/yum.go
• manager/snap/snap.go
• manager/flatpak/flatpak.go

Priority

HIGH SECURITY RISK - Command injection vulnerabilities pose significant security risks.

[homie-gg]

This might be a duplicate of: Security: Command injection vulnerability in package name handling.

[bluet]

🔄 Issue Consolidation Update

This issue has been updated to serve as the primary tracking issue for the command injection vulnerability.

✅ Duplicates Closed:

• Issue Security: Command injection vulnerability in package name handling #18 - closed as duplicate
• Issue Security: Command injection vulnerability in package name handling #19 - closed as duplicate
• Issue Security: Command injection vulnerability in package name handling #23 - primary issue (this one)

🎯 Consolidated Security Analysis:

Critical Files Affected:

• manager/apt/apt.go:89,128,234
• manager/yum/yum.go:148,200,363
• manager/snap/snap.go:59,105,194
• manager/flatpak/flatpak.go:64,107

Attack Vector:

syspkg install 'vim; rm -rf /'
# Results in: apt install vim; rm -rf /

🚨 Security Implementation Plan:

1. Create validatePackageName() function with regex validation
2. Apply validation to all package managers before exec.Command calls
3. Add comprehensive security tests for input validation
4. Update security documentation in CONTRIBUTING.md

🏷️ Labels Added:

• security - Security vulnerability
• critical - High severity issue
• bug - Code defect requiring fix

All development work for this security fix will be tracked under this issue.