Zeroday BYTE 4aae6bae1c fix(packages): shell command built from environment values (#12386) ...

https://github.com/twentyhq/twenty/blob/b7473371b3fda51de96241533dc7d56856134f72/packages/twenty-server/src/engine/core-modules/serverless/commands/add-packages.command.ts#L6-L6


https://github.com/twentyhq/twenty/blob/b7473371b3fda51de96241533dc7d56856134f72/packages/twenty-server/src/engine/core-modules/serverless/commands/add-packages.command.ts#L10-L10


https://github.com/twentyhq/twenty/blob/b7473371b3fda51de96241533dc7d56856134f72/packages/twenty-server/src/engine/core-modules/serverless/commands/add-packages.command.ts#L79-L79

Fix the issue should avoid dynamically constructing the shell command.
Instead, we can use `execFile` or `execFileSync`, which allows us to
pass arguments as an array, avoiding shell interpretation of special
characters. This ensures that the `folderPath` is treated as a literal
argument and not subject to command injection.

Specifically:
1. Replace the use of `execPromise` with `execFilePromise` (a
promisified version of `execFile`).
2. Modify the `addToGit` method to pass the `folderPath` as an argument
to `git add` instead of interpolating it into the command string.



---

2025-06-03 11:35:31 +02:00

..

@types

Permission checks on twentyORM global manager (#11477)

2025-04-23 17:57:48 +02:00

patches

Improve demo seed (#7125)

2024-09-18 17:35:08 +02:00

scripts

[QRQC_2] No implicitAny in twenty-server (#12075)

2025-05-15 18:23:22 +02:00

src

fix(packages): shell command built from environment values (#12386)

2025-06-03 11:35:31 +02:00

test

Add tests on granular settings permissions (#12403)

2025-06-02 16:16:57 +02:00

.env.example

Update enums to be all caps (#12372)

2025-05-29 14:08:36 +02:00

.env.test

Update enums to be all caps (#12372)

2025-05-29 14:08:36 +02:00

.eslintrc.cjs

[QRQC_2] No explicit any in twenty-server (#12068)

2025-05-15 16:26:38 +02:00

.gitignore

feat: add integration tests (#6923)

2024-09-20 11:02:52 +02:00

.prettierignore

Migrate to a monorepo structure (#2909)

2023-12-10 18:10:54 +01:00

.prettierrc

Migrate to a monorepo structure (#2909)

2023-12-10 18:10:54 +01:00

.swcrc

Lingui working with NODE ENV=production again (#10067)

2025-02-07 10:05:07 +01:00

jest-integration.config.ts

Update enums to be all caps (#12372)

2025-05-29 14:08:36 +02:00

jest.config.ts

[BUGFIX] ObjectMetadata item server validation (#10699)

2025-03-11 12:14:37 +01:00

lingui.config.ts

CSV Import translations and dark mode fixes (#11184)

2025-03-27 08:53:00 +01:00

nest-cli.json

Update clickhouse tables (#11905)

2025-05-07 09:39:18 +02:00

package.json

Fix datasource race condition on migrate (#12350)

2025-05-28 13:31:02 +02:00

project.json

Update what is being audit logged (#11833)

2025-05-04 14:35:41 +02:00

tsconfig.build.json

chore: set up twenty-emails config so build isn't needed in development (#3619)

2024-01-29 06:17:12 -03:00

tsconfig.json

[QRQC_2] No implicitAny in twenty-server (#12075)

2025-05-15 18:23:22 +02:00

tsconfig.scripts.json

feat: add integration tests (#6923)

2024-09-20 11:02:52 +02:00