palladius / palladius/antigravity-ruby-sdk
🐛 [Security] Shell argument splitting in Harness process invocation
Nobody has claimed this yet.
- Dominant language
- Ruby
- Stars
- 0
- Forks
- 0
- Avg merge
- 4m
- Merged PRs (30d)
- 1
Description
Description
Open3.popen3 was invoked with a single interpolated string ("#{bin_path} --port=#{port}"), which forces Ruby to invoke /bin/sh -c and introduces potential shell command injection risks if binary paths contain spaces or shell metacharacters.
Fix
Pass executable path and arguments as separate array parameters to Open3.popen3 to bypass shell evaluation.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at the Harness process invocation that calls Open3.popen3 and inspect how the executable path and port argument are passed. Update the invocation so the executable and arguments are separate parameters, then verify that paths containing spaces or shell metacharacters are not evaluated by a shell.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- ruby
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 78/100