Prevent shell injection attacks with crafted DETECTOR_PREFIX variables
Open
- Dominant language
- C++
- Stars
- 2
- Forks
- 3
- Avg merge
- 18h 31m
- Merged PRs (30d)
- 13
Description
This is a pre-existing security issue that applies to `config['DETECTOR_PREFIX']` as well... We should indeed be more careful here.
_Originally posted by @wdconinc in https://github.com/eic/detector_benchmarks/pull/339#discussion_r3959873578_
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by tracing every use of config['DETECTOR_PREFIX'] and review the linked discussion in pull request #339 for the reported injection path. Determine which invocation is unsafe and define completion as handling crafted values without allowing shell injection, with regression coverage for the affected behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp, shell
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100