fix(packages): shell command built from environment values

[odaysec]

twenty/packages/twenty-server/src/engine/core-modules/serverless/commands/add-packages.command.ts

Line 6 in b747337

import { exec } from 'child_process';

twenty/packages/twenty-server/src/engine/core-modules/serverless/commands/add-packages.command.ts

Line 10 in b747337

const execPromise = promisify(exec);

twenty/packages/twenty-server/src/engine/core-modules/serverless/commands/add-packages.command.ts

Line 79 in b747337

await execPromise(`git add ${folderPath}`);

Fix the issue should avoid dynamically constructing the shell command. Instead, we can use execFile or execFileSync, which allows us to pass arguments as an array, avoiding shell interpretation of special characters. This ensures that the folderPath is treated as a literal argument and not subject to command injection.

Specifically:

1. Replace the use of execPromise with execFilePromise (a promisified version of execFile).
2. Modify the addToGit method to pass the folderPath as an argument to git add instead of interpolating it into the command string.

---

[github-actions]

Welcome!

Hello there, congrats on your first PR! We're excited to have you contributing to this project.
By submitting your Pull Request, you acknowledge that you agree with the terms of our Contributor License Agreement.

Generated by 🚫 dangerJS against 4f574f6

[greptile-apps]

PR Summary

Security improvement to prevent command injection by replacing dynamic shell command construction with execFile in the serverless package management system.

• The installPackages method still uses unsafe execPromise with string interpolation for yarn commands, leaving a potential command injection vulnerability
• Consider using execFilePromise for yarn commands with arguments passed as an array: ['add', packageName]
• Add input validation for package names to prevent malicious input
• Consider implementing error handling for failed git operations in addToGit method

_{1 file reviewed, no comments
Edit PR Review Bot Settings | Greptile}

[github-actions]

🚀 Preview Environment Ready!

Your preview environment is available at: http://bore.pub:4908

This environment will automatically shut down when the PR is closed or after 5 hours.