Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

JS: `js/command-line-injection` misses `child_process` argument arrays when the `shell` option is set

未关闭
  • 哪里不对？
#22,825 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
4/5
预计耗时
一周以上
新手友好度
18/100
Issue 类型
缺陷
描述清晰度
基本清楚
活跃度
活跃
技术栈
express, javascript, nodejs
领域
security

调研方向

The gap is in the CodeQL JavaScript libraries, not in the issue's sample app: look at CommandInjection::SystemCommandExecutionSink and UnsafeShellCommandConstruction (executesArrayAsShell) to see how the shell option is treated. Run the three sample routes through the javascript-security-extended queries to reproduce the missed reports. Done means /b and /c are flagged by a command-injection query with tests covering shell: true and a string shell value.

由索引模型根据 Issue 内容生成。

描述

question

Description of the issue

js/command-line-injection does not report remote input that reaches the argument array of spawn/execFile when the shell option is set, although Node.js then runs the joined command line in a shell. Checked with the latest release, CodeQL 2.27.2 (codeql/javascript-queries 2.4.7).

const cp = require("child_process");
const app = require("express")();

app.get("/a", (req, res) => {
  cp.exec("echo hello " + req.query.name); // reported
  res.send("ok");
});

app.get("/b", (req, res) => {
  cp.spawn("echo", ["hello", req.query.name], { shell: true }); // not reported
  res.send("ok");
});

app.get("/c", (req, res) => {
  cp.spawn("echo", ["hello", req.query.name], { shell: "/bin/sh" }); // not reported
  res.send("ok");
});

Only /a is reported, by js/command-line-injection. For /b and /c, no query in javascript-security-extended.qls reports a command injection. At runtime both run /bin/sh -c "echo hello <name>" (Node.js joins [file, ...args] with spaces when shell is truthy; see the spawn documentation), so name = "x; touch /tmp/marker" creates the file (Node.js v24.18.0).

As far as I can tell, CommandInjection::SystemCommandExecutionSink only uses getACommandArgument(), which for spawn/execFile is the program name. The argument array is treated as shell-interpreted only in UnsafeShellCommandConstruction (executesArrayAsShell), i.e. for library inputs, and even there only for
shell: true: with a string-valued shell such as "/bin/sh", js/shell-command-constructed-from-input misses the call as well.

主要语言
CodeQL
星标
10.2k
派生
2.1k
平均合并
2 天 15 小时
30 天内合并 PR
153

环境准备

在 Codespaces 中打开

在浏览器里用你自己的 GitHub 账号启动这个项目的开发容器。

  • 没有 Dockerfile 或 Docker Compose 文件
  • 没有 Pull Request 模板
  • 阅读贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

github/codeql 的其他 Issue

查看 github/codeql 的全部 Issue

相似的 Issue

更多 Security Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。