Shell command is built from environment values

Description:

When executing the build process in different environments, the use of execSync in the build-livechat.js file poses a potential shell command injection vulnerability. The dynamic shell command construction with values from the local environment may inadvertently change the meaning of the shell command.

Steps to reproduce:

Clone the Rocket.Chat repo
Navigate to the packages/rocketchat-livechat/plugin/build-livechat.js file
Review the execSync calls within this file

https://github.com/RocketChat/Rocket.Chat/blob/90038e4316dc2f0a7cade14c5079fc2264e0fe2e/apps/meteor/packages/rocketchat-livechat/plugin/build-livechat.js#L22-L22

Expected behavior:

The shell commands should be constructed securely, to prevent potential shell command injection. Using execFileSync with arguments provided as an array can help achieve this.

Actual behavior:

Currently, execSync is used with dynamically constructed commands, which can pose a potential security risk if environment values are interpreted by the shell in an unintended way.

Server Setup Information:

Version of Rocket.Chat Server: Latest
Operating System: All
Deployment Method: All
Number of Running Instances: Not applicable
DB Replicaset Oplog: Not applicable
NodeJS Version: Not applicable
MongoDB Version: Not applicable

Client Setup Information

• Desktop App or Browser Version: NA
• Operating System: NA

Relevant logs:

No logs are available for this issue, as it pertains to code analysis rather than a runtime error.

Start in apps/meteor/packages/rocketchat-livechat/plugin/build-livechat.js, especially the execSync call at line 22, and review how environment values enter each command. Compare the build process behavior with Node.js child-process APIs. Done means the commands no longer allow environment values to alter shell interpretation; verify by running the relevant build process.