🔒 Fix command injection vulnerability in stdlib process.spawn

stdlib/Cargo.toml

@@ -36,3 +36,4 @@ uuid = { version = "1", features = ["v4"] }
 rustls = { version = "0.23", optional = true }
 tokio = { version = "1", features = ["rt", "macros", "sync", "time"], optional = true }
 hex = "0.4.3"
+shlex = "2.0.1"

stdlib/src/process.rs

@@ -114,8 +114,25 @@ impl StdlibRegistry {
  ))
  }
  };
- Command::new("cmd")
- .args(["/C", &cmd])
+
+ let parsed = shlex::split(&cmd).ok_or_else(|| {
+ RuntimeError::new(
+ RuntimeErrorKind::InvalidOperation("Failed to parse command string".to_string()),
+ None,
+ None,
+ )
+ })?;
+
+ if parsed.is_empty() {
+ return Err(RuntimeError::new(
+ RuntimeErrorKind::InvalidOperation("Empty command string".to_string()),
+ None,
+ None,
+ ));
+ }
+
+ Command::new(&parsed[0])
+ .args(&parsed[1..])
  .spawn()
  .map_err(|e| {
  RuntimeError::new(

stdlib/tests/stdlib_tests.rs

@@ -1,7 +1,7 @@
 use std::cell::RefCell;
 use std::collections::HashSet;
 use std::rc::Rc;
-use techscript_runtime::{context::Capability, value::RuntimeValue, RuntimeConfig, RuntimeContext};
+use techscript_runtime::{context::Capability, value::RuntimeValue, RuntimeConfig, RuntimeContext, error::RuntimeErrorKind};
 use techscript_stdlib::StdlibRegistry;
 
 #[test]