Sync with upstream v347

[Frzk]

Related to #147

[semgrep-code-scalingo]

Semgrep identified an issue in your code:

Shell command injection via unsanitized user input in backtick command execution. Attackers can inject arbitrary commands if the command parameter is controlled by untrusted sources.

More details about this

The run method executes a shell command constructed by interpolating command_options_to_string(command, options) directly into a backtick command. If the command parameter comes from unverified user input, an attacker can inject arbitrary shell code.

Exploit scenario:

1. An attacker provides a malicious command like "echo safe; rm -rf /" to the run() method
2. The command_options_to_string() function wraps it: /usr/bin/env bash -c echo safe; rm -rf / 2>&1
3. The backtick operator executes this in a shell, where the semicolon allows chaining commands
4. The attacker's injected rm -rf / command runs with the privileges of the Ruby process

Even though command.shellescape is used inside command_options_to_string(), the function returns a string that is then directly interpolated into the backtick without proper quoting, bypassing the escaping protection.

To resolve this comment:

✨ Commit Assistant fix suggestion

Suggested change

	`#{command_options_to_string(command, options)}`
	require 'open3'
	def run(command, options = {})
	command_array = command_options_to_array(command, options) # We'll define this helper below
	stdout_str, status = Open3.capture2e(*command_array)
	stdout_str
	end
	# Helper method to return an array for command and args for Open3
	def command_options_to_array(command, options)
	options[:env] ||= {}
	options[:env] = user_env_hash.merge(options[:env]) if options[:user_env]
	env = options[:env].transform_keys(&:to_s)
	# Build the bash command part safely
	bash_command = command.to_s
	# Anything to redirect output (e.g., "2>&1") is best handled in Ruby itself, not shell, to avoid injection.
	# We'll ignore options[:out] to avoid passing dangerous redirects; Open3.capture2e already merges stderr into stdout.
	[env, '/usr/bin/env', 'bash', '-c', bash_command]
	end

View step-by-step instructions

1. Avoid using backticks with string interpolation to execute shell commands, as this can allow command injection if any part of the command or options is user-controlled.
2. Replace the line `#{command_options_to_string(command, options)}` with usage of the safer Open3 or system method, which accepts command and arguments as an array.
3. Refactor command_options_to_string to return an array: for example, split up the command and its arguments so you can pass them to Open3.capture2e or system.
4. In the run method, replace the dangerous call with: Open3.capture2e(*command_array) (after requiring open3 at the top of the file: require 'open3'), where command_array is the securely built command and its arguments.
5. Make sure to never pass user-controlled input directly to the shell unless properly validated or escaped.

Alternatively, if you must use backticks,
validate and strictly sanitize all parts of the command string to only allow safe, expected values. This is less robust than avoiding the shell entirely.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by dangerous-subshell.

_{You can view more details about this finding in the Semgrep AppSec Platform.}