openInEditor runs the editor command through a shell
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 53/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- node.js, typescript
Research direction
Start with src/main/files.ts:58 and read how openInEditor constructs and launches the editor command; then inspect the related Windows launcher constraint in issue #178. Add tests covering editor commands with spaces in paths and with arguments, as proposed. Done means editor commands are launched without treating the command as shell text, with the Windows .cmd case handled.
Written by the indexing model from the issue text.
Description
From Finding 4b of the earlier SECURITY-REVIEW.md (also noted in the Oct 7 audit), checked against the current code.
Problem
openInEditor (src/main/files.ts:58) runs spawn(\${command} "${file}"`, { shell: true }). The file path is confined to the project and filtered for quotes, line breaks and (on POSIX) $, backtick and `. But editorCommand itself is shell text, so code; <anything> runs. Changing it needs a native confirmation, so this is not exploitable without the user, but the shell string is a fragile sink at the same trust level as the terminal.
Proposal
Split editorCommand into a program and arguments (shell-style parsing), and run spawn(program, [...args, file], { shell: false }). On Windows, .cmd launchers such as code.cmd need resolving to the executable or an explicit cmd.exe /d /s /c call with quoted arguments (see #178 for the same Node.js restriction). Add tests for editor commands with spaces in paths and with arguments.
- Dominant language
- TypeScript
- Stars
- 2
- Forks
- 2
- Avg merge
- 5h 28m
- Merged PRs (30d)
- 24
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from PierrunoYT/patch
-
Claude Code chats: tool calls made inside Claude Code subagents leave cards that end as "(stopped)"Openbug priority: low severity: low
Difficulty 2/5 1-3 hours Newbie friendliness 83/100
PierrunoYT/patch#289 ·
Maintainers usually reply within 1 day
-
bug priority: medium severity: low
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
PierrunoYT/patch#285 ·
Maintainers usually reply within 1 day
-
priority: medium security severity: low
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
PierrunoYT/patch#283 ·
Maintainers usually reply within 1 day
-
enhancement priority: medium security severity: medium
Difficulty 5/5 Over a week Newbie friendliness 35/100
PierrunoYT/patch#294 ·
Maintainers usually reply within 1 day
-
priority: low security severity: low
Difficulty 4/5 1-2 days Newbie friendliness 38/100
PierrunoYT/patch#293 ·
Maintainers usually reply within 1 day
All issues in PierrunoYT/patch
Similar issues
-
status: needs-triage
Difficulty 2/5 1-3 hours Newbie friendliness 83/100
a2ui-project/a2ui#3158 ·
Maintainers usually reply within 2 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
hemilabs/ui-monorepo#2475 ·
Maintainers usually reply within 1 day
-
community first-timers-only good first issue hacktoberfest help wanted low hanging fruit up-for-grabs
Difficulty 1/5 Under an hour Newbie friendliness 82/100
lingdojo/kana-dojo#32279 · 1 comment · 5 reactions ·
Maintainers usually reply within 1 day
-
code-quality refactoring
Difficulty 2/5 1-3 hours Newbie friendliness 77/100
github/gh-aw-firewall#9879 ·
Maintainers usually reply within 1 day
-
[Bug]: Arrow-key cursor movement in combined diff view doesn't scroll to keep the cursor visibleOpenos:macos
Difficulty 2/5 1-3 hours Newbie friendliness 64/100
Maintainers usually reply within 1 day