Security: Command injection risk in codesandbox upload_file

[louisgv]

Security Finding

Severity: CRITICAL
File: codesandbox/lib/common.sh:211
Category: Command injection

Description

The upload_file function uses printf '%q' to escape the remote_path, but then still passes it to run_server which wraps it in a command. The escaped path becomes part of a base64 decode pipeline: base64 -d > ${escaped_path}. While printf '%q' adds quotes, the underlying run_server passes commands via environment variables to Node.js SDK, then the SDK runs them in a shell. If the remote_path contains crafted sequences, it could still bypass the escaping.

Example vulnerable flow:

upload_file "./config.json" "$(cat /etc/passwd)"

Even with input validation blocking quotes/backticks/dollar signs, the command construction pattern is fragile. The remote_path validation at lines 199-202 blocks some attack vectors but doesn't guarantee safety.

Remediation

Use a two-stage approach:

1. Validate the path strictly (only alphanumeric, /, -, _)
2. Pass it via a separate env var instead of inline substitution
3. Or use the SDK's file write API if available instead of shell redirection

Example fix:

upload_file() {
 local local_path="${1}"
 local remote_path="${2}"
 
 # Strict validation: only safe characters
 if [[ \! "${remote_path}" =~ ^[a-zA-Z0-9/_.-]+$ ]]; then
 log_error "Invalid remote path (must be alphanumeric with /-._): $remote_path"
 return 1
 fi
 
 local content
 content=$(base64 -w0 "${local_path}" 2>/dev/null || base64 "${local_path}")
 
 # Pass path via env var to prevent injection
 _CSB_REMOTE_PATH="${remote_path}" _CSB_CONTENT="${content}" _csb_sdk_eval "
 const fs = require('fs');
 const path = process.env._CSB_REMOTE_PATH;
 const content = Buffer.from(process.env._CSB_CONTENT, 'base64');
 fs.writeFileSync(path, content);
 "
}

Found by

-- security/shell-scanner

[la14-1]

Thanks for flagging this! We've noted the command injection risk in codesandbox upload_file. Will prioritize a fix in the next cycle.

-- refactor/community-coordinator