W-23795356- resolve binaries from PATH to prevent CWD-based RCE

README.md

@@ -156,7 +156,7 @@ FLAG DESCRIPTIONS
  The default is the "src" directory in the current working directory.
 ```
 
-_See code: [src/commands/dev/audit/messages.ts](https://github.com/salesforcecli/plugin-dev/blob/2.5.2/src/commands/dev/audit/messages.ts)_
+_See code: [src/commands/dev/audit/messages.ts](https://github.com/salesforcecli/plugin-dev/blob/2.5.3-qa.0/src/commands/dev/audit/messages.ts)_
 
 ## `sf dev convert messages`
 
@@ -191,7 +191,7 @@ EXAMPLES
  $ sf dev convert messages --project-dir ./path/to/plugin --filename my-command.json
 ```
 
-_See code: [src/commands/dev/convert/messages.ts](https://github.com/salesforcecli/plugin-dev/blob/2.5.2/src/commands/dev/convert/messages.ts)_
+_See code: [src/commands/dev/convert/messages.ts](https://github.com/salesforcecli/plugin-dev/blob/2.5.3-qa.0/src/commands/dev/convert/messages.ts)_
 
 ## `sf dev convert script`
 
@@ -235,7 +235,7 @@ EXAMPLES
  $ sf dev convert script --script ./myScript.yml
 ```
 
-_See code: [src/commands/dev/convert/script.ts](https://github.com/salesforcecli/plugin-dev/blob/2.5.2/src/commands/dev/convert/script.ts)_
+_See code: [src/commands/dev/convert/script.ts](https://github.com/salesforcecli/plugin-dev/blob/2.5.3-qa.0/src/commands/dev/convert/script.ts)_
 
 ## `sf dev generate command`
 
@@ -276,7 +276,7 @@ EXAMPLES
  $ sf dev generate command --name my:exciting:command
 ```
 
-_See code: [src/commands/dev/generate/command.ts](https://github.com/salesforcecli/plugin-dev/blob/2.5.2/src/commands/dev/generate/command.ts)_
+_See code: [src/commands/dev/generate/command.ts](https://github.com/salesforcecli/plugin-dev/blob/2.5.3-qa.0/src/commands/dev/generate/command.ts)_
 
 ## `sf dev generate flag`
 
@@ -316,7 +316,7 @@ EXAMPLES
  $ sf dev generate flag --dry-run
 ```
 
-_See code: [src/commands/dev/generate/flag.ts](https://github.com/salesforcecli/plugin-dev/blob/2.5.2/src/commands/dev/generate/flag.ts)_
+_See code: [src/commands/dev/generate/flag.ts](https://github.com/salesforcecli/plugin-dev/blob/2.5.3-qa.0/src/commands/dev/generate/flag.ts)_
 
 ## `sf dev generate plugin`
 
@@ -350,6 +350,6 @@ EXAMPLES
  $ sf dev generate plugin
 ```
 
-_See code: [src/commands/dev/generate/plugin.ts](https://github.com/salesforcecli/plugin-dev/blob/2.5.2/src/commands/dev/generate/plugin.ts)_
+_See code: [src/commands/dev/generate/plugin.ts](https://github.com/salesforcecli/plugin-dev/blob/2.5.3-qa.0/src/commands/dev/generate/plugin.ts)_
 
 <!-- commandsstop -->

package.json

@@ -1,7 +1,7 @@
 {
  "name": "@salesforce/plugin-dev",
  "description": "commands for sf plugin development",
- "version": "2.5.2",
+ "version": "2.5.3-qa.0",
  "author": "Salesforce",
  "bugs": "https://github.com/forcedotcom/cli/issues",
  "dependencies": {

src/commands/dev/generate/command.ts

@@ -107,7 +107,9 @@ export default class GenerateCommand extends SfCommand<void> {
 
  if (Object.keys(generator.pjson.devDependencies).includes('@salesforce/plugin-command-reference')) {
  // Get a list of all commands in `sf`. We will use this to determine if a topic is internal or external.
- const sfCommandsStdout = shelljs.exec('sf commands --json', { silent: true }).stdout;
+ const sfBin = shelljs.which('sf');
+ if (!sfBin) throw messages.createError('errors.InvalidDir');
+ const sfCommandsStdout = shelljs.exec(`${sfBin} commands --json`, { silent: true }).stdout;
  const commandsJson = JSON.parse(sfCommandsStdout) as Array<{ id: string }>;
  const commands = commandsJson.map((command) => command.id.replace(/:/g, '.').replace(/ /g, '.'));
 

src/commands/dev/generate/flag.ts

@@ -9,7 +9,6 @@ import path from 'node:path';
 import os from 'node:os';
 import fs from 'node:fs/promises';
 import select from '@inquirer/select';
-import shelljs from 'shelljs';
 import { SfCommand, Flags } from '@salesforce/sf-plugins-core';
 import { Messages } from '@salesforce/core';
 import { toStandardizedId } from '@oclif/core';
@@ -18,6 +17,7 @@ import { askQuestions } from '../../../prompts/series/flagPrompts.js';
 import { fileExists, build, apply, resolveCommandFilePath } from '../../../util.js';
 import { FlagAnswers } from '../../../types.js';
 import { stringToChoice } from '../../../prompts/functions.js';
+import { Generator } from '../../../generator.js';
 
 Messages.importMessagesDirectoryFromMetaUrl(import.meta.url);
 export const messages = Messages.loadMessages('@salesforce/plugin-dev', 'dev.generate.flag');
@@ -66,9 +66,10 @@ export default class DevGenerateFlag extends SfCommand<void> {
 
  await updateMarkdownFile(answers, existing, standardizedCommandId);
 
- shelljs.exec(`yarn prettier --write ${commandFilePath}`);
+ const generator = new Generator({ dryRun: flags['dry-run'] });
+ generator.execute(`yarn prettier --write ${commandFilePath}`);
 
-shelljs.exec('yarn compile');
+generator.execute('yarn compile');
 
  this.log(`Added ${answers.name} flag to ${commandFilePath}`);
  }

src/commands/dev/generate/plugin.ts

@@ -49,7 +49,9 @@ async function fetchGithubUserFromAPI(): Promise<{ login: string; name: string }
 
 function fetchGithubUserFromGit(): string | undefined {
  try {
- const result = shelljs.exec('git config --get user.name', { silent: true });
+ const gitBin = shelljs.which('git');
+ if (!gitBin) return undefined;
+ const result = shelljs.exec(`${gitBin} config --get user.name`, { silent: true });
  return result.stdout.trim();
  } catch {
  // ignore

src/generator.ts

@@ -88,8 +88,17 @@ export class Generator {
  return;
  }
 
- this.logger.debug(`Executing command: ${cmd}`);
- shelljs.exec(cmd, { cwd: this.cwd });
+ const args = cmd.split(' ');
+ const bin = args[0];
+ const isBinPath = bin.includes('/') || bin.includes('\\');
+ const resolved = isBinPath ? bin : shelljs.which(bin);
+ if (!resolved) {
+ throw new Error(`Could not find "${bin}" on PATH`);
+ }
+ const resolvedCmd = [resolved.toString(), ...args.slice(1)].join(' ');
+
+ this.logger.debug(`Executing command: ${resolvedCmd}`);
+ shelljs.exec(resolvedCmd, { cwd: this.cwd });
  }
 
  public async loadPjson(): Promise<PackageJson> {

test/generator.test.ts

@@ -0,0 +1,25 @@
+/*
+ * Copyright (c) 2024, salesforce.com, inc.
+ * All rights reserved.
+ * Licensed under the BSD 3-Clause license.
+ * For full license text, see LICENSE.txt file in the repo root or https://opensource.org/licenses/BSD-3-Clause
+ */
+
+import { expect } from 'chai';
+import { Generator } from '../src/generator.js';
+
+describe('Generator.execute', () => {
+ it('should throw when binary is not found on PATH', () => {
+ const generator = new Generator();
+
+ expect(() => generator.execute('nonexistent-binary-xyz --help')).to.throw(
+ 'Could not find "nonexistent-binary-xyz" on PATH'
+ );
+ });
+
+ it('should not execute commands in dry-run mode', () => {
+ const generator = new Generator({ dryRun: true });
+
+ generator.execute('nonexistent-binary-xyz --help');
+ });
+});