fix: harden entrypoint — injection shell, erreurs silencieuses, DRY#9
Open
Guimove wants to merge 1 commit into
Open
fix: harden entrypoint — injection shell, erreurs silencieuses, DRY#9Guimove wants to merge 1 commit into
Guimove wants to merge 1 commit into
Conversation
…olations
- fix(security): replace inline GIT_TOKEN interpolation in git credential
helper with a helper script that reads env vars at invocation time —
prevents shell injection when TOKEN contains ", ;, $() or backticks
- fix(security): validate DEV_PORT and OPENCODE_PORT as integers on startup —
prevents sed delimiter injection ("|" breaks command, "&" corrupts output)
in the welcome page HTML generation
- fix(ux): pipe PRE_START_SCRIPT output through tee so failures are visible
in docker logs; check PIPESTATUS[0] and exit with the real code instead of
swallowing the error behind a log redirect
- refactor(dry): extract detect_dev_cmd() shared by detect_and_start_devserver
and generate_tasks_json — eliminates duplicated framework detection logic
that had already diverged (Flask/FastAPI/Rails/Go/Static HTML were missing
from generate_tasks_json, npm run preview was missing from detect_and_start)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Contexte
Revue de code complète du projet. Ce PR adresse 4 des 8 findings retenus.
Changements
🔴 Critique — Injection shell via
GIT_TOKENAvant :
GIT_TOKENétait interpolé directement dans la string du credential helper bash, permettant à un token contenant",;,$()d'injecter du code exécuté par git.Après : Le helper est un script indépendant
/tmp/git-cred-helper.shqui lit les credentials depuis des env vars à l'invocation — aucune valeur n'est jamais embarquée dans du code shell.🟡 Injection sed via
DEV_PORTDEV_PORTétait injecté sans validation dans une commandesed -i "s|...||". Un pipe|cassait le délimiteur sed ; un&corrompait l'output HTML.Fix : validation numérique au démarrage avec fallback + warning.
🟡
PRE_START_SCRIPT: échec invisible dansdocker logsAvec
set -e, un script en échec tuait le container sans rien afficher (stdout+stderr redirigés vers un log file).docker logsne montrait rien.Fix :
teevers stdout + vérification dePIPESTATUS[0]+ exit avec le vrai code.🔵 DRY — Détection framework dupliquée
detect_and_start_devserver()etgenerate_tasks_json()détectaient le type de projet indépendamment et avaient déjà divergé (Flask/FastAPI/Rails/Go/Static HTML manquants dansgenerate_tasks_json,npm run previewmanquant dansdetect_and_start_devserver).Fix : extraction de
detect_dev_cmd(dir, port)utilisée par les deux appelants.Points non traités (Dockerfile off-limits, ou hors scope)
masternon pinnée (fix: write settings.json via printf and set bash as default terminal shell #3)EXPOSE(fix(docker): harden Dockerfile — pipefail, no curl|bash, healthcheck, .dockerignore #8)🤖 Generated with Claude Code