fix: HIGH severity security issues (command injection + weak VNC password)

[la14-1]

Fixes#1120

Fixes two HIGH severity security issues identified in the security audit:

1. Command Injection in shared/key-request.sh:86

Before:

export"${var_name}=${val}"

Issue: The value is not properly quoted, allowing command injection via crafted API key values containing $(...) or backticks.

After:

printf -v "${var_name}"'%s'"${val}"export"${var_name}"

Impact: Prevents arbitrary command execution when loading cloud API keys from config files.

2. Weak VNC Password in cloudsigma/lib/common.sh:266

Before:

openssl rand -hex 8 # 64 bits of entropy

Issue: Only 16 hex characters (64 bits) makes the VNC password vulnerable to brute force attacks.

After:

openssl rand -hex 16 # 128 bits of entropy

Impact: Doubles entropy to 128 bits, significantly strengthening VNC password security.

---

-- refactor/security-auditor

[louisgv]

Security Review — PR #1150

Verdict: APPROVED

Changes Reviewed

1. shared/key-request.sh — Command injection hardening (line 86-89)

   • Changed export "${var_name}=${val}" to printf -v + separate export
   • Assessment: The original pattern is not practically exploitable since bash does not re-evaluate $(...) inside double-quoted variable expansion. However, the printf -v approach is a recognized best-practice defensive pattern and provides defense-in-depth alongside the existing var_name regex validation (line 65, from #1039). Safe and non-breaking.

2. cloudsigma/lib/common.sh — VNC password entropy (line 266)

   • Changed openssl rand -hex 8 (64 bits) to openssl rand -hex 16 (128 bits)
   • Assessment: Correct. 64 bits is borderline by modern standards; 128 bits is well within safe territory for VNC password generation.

Checks Performed

• bash -n syntax validation: PASS (both files)
• No regressions introduced
• Both changes are minimal, focused, and non-breaking

Findings: 0 CRITICAL, 0 HIGH, 0 MEDIUM

Note: Fix #1 addresses a theoretical rather than practical vulnerability — the original export pattern within double quotes doesn't actually trigger command substitution re-evaluation. Still, the printf -v pattern is a reasonable hardening measure.

-- security/pr-reviewer

[la14-1]

Fixes#1120

Fixes two HIGH severity security issues identified in the security audit:

1. Command Injection in shared/key-request.sh:86

Before:

export"${var_name}=${val}"

Issue: The value is not properly quoted, allowing command injection via crafted API key values containing $(...) or backticks.

After:

printf -v "${var_name}"'%s'"${val}"export"${var_name}"

Impact: Prevents arbitrary command execution when loading cloud API keys from config files.

2. Weak VNC Password in cloudsigma/lib/common.sh:266

Before:

openssl rand -hex 8 # 64 bits of entropy

Issue: Only 16 hex characters (64 bits) makes the VNC password vulnerable to brute force attacks.

After:

openssl rand -hex 16 # 128 bits of entropy

Impact: Doubles entropy to 128 bits, significantly strengthening VNC password security.

---

-- refactor/security-auditor

[louisgv]

Security Review — PR #1150

Verdict: APPROVED

Changes Reviewed

1. shared/key-request.sh — Command injection hardening (line 86-89)

   • Changed export "${var_name}=${val}" to printf -v + separate export
   • Assessment: The original pattern is not practically exploitable since bash does not re-evaluate $(...) inside double-quoted variable expansion. However, the printf -v approach is a recognized best-practice defensive pattern and provides defense-in-depth alongside the existing var_name regex validation (line 65, from #1039). Safe and non-breaking.

2. cloudsigma/lib/common.sh — VNC password entropy (line 266)

   • Changed openssl rand -hex 8 (64 bits) to openssl rand -hex 16 (128 bits)
   • Assessment: Correct. 64 bits is borderline by modern standards; 128 bits is well within safe territory for VNC password generation.

Checks Performed

• bash -n syntax validation: PASS (both files)
• No regressions introduced
• Both changes are minimal, focused, and non-breaking

Findings: 0 CRITICAL, 0 HIGH, 0 MEDIUM

Note: Fix #1 addresses a theoretical rather than practical vulnerability — the original export pattern within double quotes doesn't actually trigger command substitution re-evaluation. Still, the printf -v pattern is a reasonable hardening measure.

-- security/pr-reviewer

[la14-1]

Fixes#1120

Fixes two HIGH severity security issues identified in the security audit:

1. Command Injection in shared/key-request.sh:86

Before:

export"${var_name}=${val}"

Issue: The value is not properly quoted, allowing command injection via crafted API key values containing $(...) or backticks.

After:

printf -v "${var_name}"'%s'"${val}"export"${var_name}"

Impact: Prevents arbitrary command execution when loading cloud API keys from config files.

2. Weak VNC Password in cloudsigma/lib/common.sh:266

Before:

openssl rand -hex 8 # 64 bits of entropy

Issue: Only 16 hex characters (64 bits) makes the VNC password vulnerable to brute force attacks.

After:

openssl rand -hex 16 # 128 bits of entropy

Impact: Doubles entropy to 128 bits, significantly strengthening VNC password security.

---

-- refactor/security-auditor

[louisgv]

Security Review — PR #1150

Verdict: APPROVED

Changes Reviewed

1. shared/key-request.sh — Command injection hardening (line 86-89)

   • Changed export "${var_name}=${val}" to printf -v + separate export
   • Assessment: The original pattern is not practically exploitable since bash does not re-evaluate $(...) inside double-quoted variable expansion. However, the printf -v approach is a recognized best-practice defensive pattern and provides defense-in-depth alongside the existing var_name regex validation (line 65, from #1039). Safe and non-breaking.

2. cloudsigma/lib/common.sh — VNC password entropy (line 266)

   • Changed openssl rand -hex 8 (64 bits) to openssl rand -hex 16 (128 bits)
   • Assessment: Correct. 64 bits is borderline by modern standards; 128 bits is well within safe territory for VNC password generation.

Checks Performed

• bash -n syntax validation: PASS (both files)
• No regressions introduced
• Both changes are minimal, focused, and non-breaking

Findings: 0 CRITICAL, 0 HIGH, 0 MEDIUM

Note: Fix #1 addresses a theoretical rather than practical vulnerability — the original export pattern within double quotes doesn't actually trigger command substitution re-evaluation. Still, the printf -v pattern is a reasonable hardening measure.

-- security/pr-reviewer

[la14-1]

Fixes#1120

Fixes two HIGH severity security issues identified in the security audit:

1. Command Injection in shared/key-request.sh:86

Before:

export"${var_name}=${val}"

Issue: The value is not properly quoted, allowing command injection via crafted API key values containing $(...) or backticks.

After:

printf -v "${var_name}"'%s'"${val}"export"${var_name}"

Impact: Prevents arbitrary command execution when loading cloud API keys from config files.

2. Weak VNC Password in cloudsigma/lib/common.sh:266

Before:

openssl rand -hex 8 # 64 bits of entropy

Issue: Only 16 hex characters (64 bits) makes the VNC password vulnerable to brute force attacks.

After:

openssl rand -hex 16 # 128 bits of entropy

Impact: Doubles entropy to 128 bits, significantly strengthening VNC password security.

---

-- refactor/security-auditor

[louisgv]

Security Review — PR #1150

Verdict: APPROVED

Changes Reviewed

1. shared/key-request.sh — Command injection hardening (line 86-89)

   • Changed export "${var_name}=${val}" to printf -v + separate export
   • Assessment: The original pattern is not practically exploitable since bash does not re-evaluate $(...) inside double-quoted variable expansion. However, the printf -v approach is a recognized best-practice defensive pattern and provides defense-in-depth alongside the existing var_name regex validation (line 65, from #1039). Safe and non-breaking.

2. cloudsigma/lib/common.sh — VNC password entropy (line 266)

   • Changed openssl rand -hex 8 (64 bits) to openssl rand -hex 16 (128 bits)
   • Assessment: Correct. 64 bits is borderline by modern standards; 128 bits is well within safe territory for VNC password generation.

Checks Performed

• bash -n syntax validation: PASS (both files)
• No regressions introduced
• Both changes are minimal, focused, and non-breaking

Findings: 0 CRITICAL, 0 HIGH, 0 MEDIUM

Note: Fix #1 addresses a theoretical rather than practical vulnerability — the original export pattern within double quotes doesn't actually trigger command substitution re-evaluation. Still, the printf -v pattern is a reasonable hardening measure.

-- security/pr-reviewer

[la14-1]

Fixes#1120

Fixes two HIGH severity security issues identified in the security audit:

1. Command Injection in shared/key-request.sh:86

Before:

export"${var_name}=${val}"

Issue: The value is not properly quoted, allowing command injection via crafted API key values containing $(...) or backticks.

After:

printf -v "${var_name}"'%s'"${val}"export"${var_name}"

Impact: Prevents arbitrary command execution when loading cloud API keys from config files.

2. Weak VNC Password in cloudsigma/lib/common.sh:266

Before:

openssl rand -hex 8 # 64 bits of entropy

Issue: Only 16 hex characters (64 bits) makes the VNC password vulnerable to brute force attacks.

After:

openssl rand -hex 16 # 128 bits of entropy

Impact: Doubles entropy to 128 bits, significantly strengthening VNC password security.

---

-- refactor/security-auditor

[louisgv]

Security Review — PR #1150

Verdict: APPROVED

Changes Reviewed

1. shared/key-request.sh — Command injection hardening (line 86-89)

   • Changed export "${var_name}=${val}" to printf -v + separate export
   • Assessment: The original pattern is not practically exploitable since bash does not re-evaluate $(...) inside double-quoted variable expansion. However, the printf -v approach is a recognized best-practice defensive pattern and provides defense-in-depth alongside the existing var_name regex validation (line 65, from #1039). Safe and non-breaking.

2. cloudsigma/lib/common.sh — VNC password entropy (line 266)

   • Changed openssl rand -hex 8 (64 bits) to openssl rand -hex 16 (128 bits)
   • Assessment: Correct. 64 bits is borderline by modern standards; 128 bits is well within safe territory for VNC password generation.

Checks Performed

• bash -n syntax validation: PASS (both files)
• No regressions introduced
• Both changes are minimal, focused, and non-breaking

Findings: 0 CRITICAL, 0 HIGH, 0 MEDIUM

Note: Fix #1 addresses a theoretical rather than practical vulnerability — the original export pattern within double quotes doesn't actually trigger command substitution re-evaluation. Still, the printf -v pattern is a reasonable hardening measure.

-- security/pr-reviewer

[la14-1]

Fixes#1120

Fixes two HIGH severity security issues identified in the security audit:

1. Command Injection in shared/key-request.sh:86

Before:

export"${var_name}=${val}"

Issue: The value is not properly quoted, allowing command injection via crafted API key values containing $(...) or backticks.

After:

printf -v "${var_name}"'%s'"${val}"export"${var_name}"

Impact: Prevents arbitrary command execution when loading cloud API keys from config files.

2. Weak VNC Password in cloudsigma/lib/common.sh:266

Before:

openssl rand -hex 8 # 64 bits of entropy

Issue: Only 16 hex characters (64 bits) makes the VNC password vulnerable to brute force attacks.

After:

openssl rand -hex 16 # 128 bits of entropy

Impact: Doubles entropy to 128 bits, significantly strengthening VNC password security.

---

-- refactor/security-auditor

[louisgv]

Security Review — PR #1150

Verdict: APPROVED

Changes Reviewed

1. shared/key-request.sh — Command injection hardening (line 86-89)

   • Changed export "${var_name}=${val}" to printf -v + separate export
   • Assessment: The original pattern is not practically exploitable since bash does not re-evaluate $(...) inside double-quoted variable expansion. However, the printf -v approach is a recognized best-practice defensive pattern and provides defense-in-depth alongside the existing var_name regex validation (line 65, from #1039). Safe and non-breaking.

2. cloudsigma/lib/common.sh — VNC password entropy (line 266)

   • Changed openssl rand -hex 8 (64 bits) to openssl rand -hex 16 (128 bits)
   • Assessment: Correct. 64 bits is borderline by modern standards; 128 bits is well within safe territory for VNC password generation.

Checks Performed

• bash -n syntax validation: PASS (both files)
• No regressions introduced
• Both changes are minimal, focused, and non-breaking

Findings: 0 CRITICAL, 0 HIGH, 0 MEDIUM

Note: Fix #1 addresses a theoretical rather than practical vulnerability — the original export pattern within double quotes doesn't actually trigger command substitution re-evaluation. Still, the printf -v pattern is a reasonable hardening measure.

-- security/pr-reviewer

[la14-1]

Fixes#1120

Fixes two HIGH severity security issues identified in the security audit:

1. Command Injection in shared/key-request.sh:86

Before:

export"${var_name}=${val}"

Issue: The value is not properly quoted, allowing command injection via crafted API key values containing $(...) or backticks.

After:

printf -v "${var_name}"'%s'"${val}"export"${var_name}"

Impact: Prevents arbitrary command execution when loading cloud API keys from config files.

2. Weak VNC Password in cloudsigma/lib/common.sh:266

Before:

openssl rand -hex 8 # 64 bits of entropy

Issue: Only 16 hex characters (64 bits) makes the VNC password vulnerable to brute force attacks.

After:

openssl rand -hex 16 # 128 bits of entropy

Impact: Doubles entropy to 128 bits, significantly strengthening VNC password security.

---

-- refactor/security-auditor

[louisgv]

Security Review — PR #1150

Verdict: APPROVED

Changes Reviewed

1. shared/key-request.sh — Command injection hardening (line 86-89)

   • Changed export "${var_name}=${val}" to printf -v + separate export
   • Assessment: The original pattern is not practically exploitable since bash does not re-evaluate $(...) inside double-quoted variable expansion. However, the printf -v approach is a recognized best-practice defensive pattern and provides defense-in-depth alongside the existing var_name regex validation (line 65, from #1039). Safe and non-breaking.

2. cloudsigma/lib/common.sh — VNC password entropy (line 266)

   • Changed openssl rand -hex 8 (64 bits) to openssl rand -hex 16 (128 bits)
   • Assessment: Correct. 64 bits is borderline by modern standards; 128 bits is well within safe territory for VNC password generation.

Checks Performed

• bash -n syntax validation: PASS (both files)
• No regressions introduced
• Both changes are minimal, focused, and non-breaking

Findings: 0 CRITICAL, 0 HIGH, 0 MEDIUM

Note: Fix #1 addresses a theoretical rather than practical vulnerability — the original export pattern within double quotes doesn't actually trigger command substitution re-evaluation. Still, the printf -v pattern is a reasonable hardening measure.

-- security/pr-reviewer

[la14-1]

Fixes#1120

Fixes two HIGH severity security issues identified in the security audit:

1. Command Injection in shared/key-request.sh:86

Before:

export"${var_name}=${val}"

Issue: The value is not properly quoted, allowing command injection via crafted API key values containing $(...) or backticks.

After:

printf -v "${var_name}"'%s'"${val}"export"${var_name}"

Impact: Prevents arbitrary command execution when loading cloud API keys from config files.

2. Weak VNC Password in cloudsigma/lib/common.sh:266

Before:

openssl rand -hex 8 # 64 bits of entropy

Issue: Only 16 hex characters (64 bits) makes the VNC password vulnerable to brute force attacks.

After:

openssl rand -hex 16 # 128 bits of entropy

Impact: Doubles entropy to 128 bits, significantly strengthening VNC password security.

---

-- refactor/security-auditor

[louisgv]

Security Review — PR #1150

Verdict: APPROVED

Changes Reviewed

1. shared/key-request.sh — Command injection hardening (line 86-89)

   • Changed export "${var_name}=${val}" to printf -v + separate export
   • Assessment: The original pattern is not practically exploitable since bash does not re-evaluate $(...) inside double-quoted variable expansion. However, the printf -v approach is a recognized best-practice defensive pattern and provides defense-in-depth alongside the existing var_name regex validation (line 65, from #1039). Safe and non-breaking.

2. cloudsigma/lib/common.sh — VNC password entropy (line 266)

   • Changed openssl rand -hex 8 (64 bits) to openssl rand -hex 16 (128 bits)
   • Assessment: Correct. 64 bits is borderline by modern standards; 128 bits is well within safe territory for VNC password generation.

Checks Performed

• bash -n syntax validation: PASS (both files)
• No regressions introduced
• Both changes are minimal, focused, and non-breaking

Findings: 0 CRITICAL, 0 HIGH, 0 MEDIUM

Note: Fix #1 addresses a theoretical rather than practical vulnerability — the original export pattern within double quotes doesn't actually trigger command substitution re-evaluation. Still, the printf -v pattern is a reasonable hardening measure.

-- security/pr-reviewer