Release 3.1.1

.github/dependabot.yml

@@ -0,0 +1,16 @@
+# Keeps the commit-SHA pins in .github/workflows/ maintained.
+# Pinning actions to an immutable SHA (rather than a mutable tag) is what stops a
+# compromised or re-pointed action tag from executing in the release job; Dependabot
+# is what stops those pins from going stale.
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    # Wait 7 days before proposing a bump to a newly published action version,
+    # so a compromised or yanked release is caught upstream before it reaches CI.
+    cooldown:
+      default-days: 7
+    commit-message:
+      prefix: "ci"

.github/workflows/cd.yml

@@ -2,6 +2,12 @@ name: .NET package CD
 
 on: [workflow_dispatch]
 
+# Least privilege: no step in this workflow writes to the repo,
+# releases or packages via GITHUB_TOKEN (publishing uses NUGET_API_KEY,
+# signing uses GCP_SA_KEY). Fail closed regardless of the org default.
+permissions:
+  contents: read
+
 defaults:
   run:
     working-directory: BrowserStackLocal
@@ -11,9 +17,9 @@ jobs:
     runs-on: windows-latest
 
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2
     - name: Add msbuild to PATH
-      uses: microsoft/setup-msbuild@v1.0.2
+      uses: microsoft/setup-msbuild@c26a08ba26249b81327e26f6ef381897b6a8754d # v1.0.2
     - name: Build BrowserStackLocal
       run: |
         msbuild BrowserStackLocal -t:restore -p:Configuration=Release
@@ -23,7 +29,7 @@ jobs:
         msbuild BrowserStackLocalIntegrationTests -t:restore -p:Configuration=Release
         msbuild BrowserStackLocalIntegrationTests -t:build -p:Configuration=Release
     - name: Setup .NET Core
-      uses: actions/setup-dotnet@v3
+      uses: actions/setup-dotnet@55ec9447dda3d1cf6bd587150f3262f30ee10815 # v3
       with:
         dotnet-version: 6.0.x
     - name: Setup GCP credentials
@@ -40,7 +46,7 @@ jobs:
       run: python3 -m pip install google-auth requests
       shell: bash
     - name: Setup Java
-      uses: actions/setup-java@v4
+      uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4
       with:
         distribution: 'temurin'
         java-version: '17'
@@ -58,7 +64,7 @@ jobs:
         ./scripts/sign_nupkg.sh
       shell: bash
     - name: Save artifact
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: BrowserStackLocal.nupkg
         path: .\BrowserStackLocal\BrowserStackLocal\bin\Release\*.nupkg

.github/workflows/ci.yml

@@ -2,6 +2,12 @@ name: .NET package CI
 
 on: [workflow_dispatch]
 
+# Least privilege: no step in this workflow writes to the repo,
+# releases or packages via GITHUB_TOKEN (publishing uses NUGET_API_KEY,
+# signing uses GCP_SA_KEY). Fail closed regardless of the org default.
+permissions:
+  contents: read
+
 defaults:
   run:
     working-directory: BrowserStackLocal
@@ -11,9 +17,9 @@ jobs:
     runs-on: windows-latest
 
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2
     - name: Add msbuild to PATH
-      uses: microsoft/setup-msbuild@v1.0.2
+      uses: microsoft/setup-msbuild@c26a08ba26249b81327e26f6ef381897b6a8754d # v1.0.2
     - name: Build BrowserStackLocal
       run: |
         msbuild BrowserStackLocal -t:restore -p:Configuration=Release
@@ -23,7 +29,7 @@ jobs:
         msbuild BrowserStackLocalIntegrationTests -t:restore -p:Configuration=Release
         msbuild BrowserStackLocalIntegrationTests -t:build -p:Configuration=Release
     - name: Setup .NET Core
-      uses: actions/setup-dotnet@v3
+      uses: actions/setup-dotnet@55ec9447dda3d1cf6bd587150f3262f30ee10815 # v3
       with:
         dotnet-version: 6.0.x
     - name: Run Integration Tests
@@ -34,7 +40,7 @@ jobs:
     - name: Pack NuGet Package
       run: msbuild BrowserStackLocal -t:pack -p:Configuration=Release
     - name: Save artifact
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: BrowserStackLocal.nupkg
         path: .\BrowserStackLocal\BrowserStackLocal\bin\Release\*.nupkg

BrowserStackLocal/BrowserStackLocal Unit Tests/BrowserStackTunnelTests.cs

@@ -5,6 +5,7 @@
 
 using NUnit.Framework;
 using BrowserStack;
+using System.Collections.Generic;
 using System.Text;
 using System.IO;
 
@@ -91,15 +92,15 @@ public void TestBinaryPathOnNoMoreFallback()
     public void TestBinaryArguments()
     {
       tunnel = new TunnelClass();
-      tunnel.addBinaryArguments("dummyArguments");
-      Assert.AreEqual(tunnel.getBinaryArguments(), "dummyArguments");
+      tunnel.addBinaryArguments(new List<string> { "-dummyFlag", "dummyValue" });
+      CollectionAssert.AreEqual(new List<string> { "-dummyFlag", "dummyValue" }, tunnel.getBinaryArguments());
     }
     [TestMethod]
     public void TestBinaryArgumentsAreEmptyOnNull()
     {
       tunnel = new TunnelClass();
       tunnel.addBinaryArguments(null);
-      Assert.AreEqual(tunnel.getBinaryArguments(), "");
+      Assert.IsEmpty(tunnel.getBinaryArguments());
     }
 
 
@@ -130,9 +131,74 @@ public void testFallbackException()
     {
       tunnel.fallbackPaths();
     }
+
+    // Regression for the chmod shell-metacharacter injection (F-001): binaryAbsolute must
+    // reach chmod as a single argument, never interpolated into a shell command line. On
+    // pre-fix code (`bash -c "chmod 0755 <path>"`) the payload below runs `touch <marker>`
+    // and never chmods the real file, so BOTH asserts fail; the fix (`/bin/chmod` +
+    // ArgumentList) creates no marker and chmods the real path. Unix-only: on Windows
+    // modifyBinaryPermission takes the ACL branch, not chmod.
+    [TestMethod]
+    public void TestModifyBinaryPermissionDoesNotInterpretShellMetacharacters()
+    {
+      if (os.Platform.ToString() != "Unix")
+      {
+        Assert.Ignore("Unix-only: Windows takes the ACL branch in modifyBinaryPermission, not chmod");
+        return;
+      }
+
+      string prevCwd = Directory.GetCurrentDirectory();
+      // Space-free working dir so the injected `touch pwned` (if it runs) lands here deterministically.
+      string work = Path.Combine(Path.GetTempPath(), "bsloc" + Guid.NewGuid().ToString("N"));
+      Directory.CreateDirectory(work);
+      Directory.SetCurrentDirectory(work);
+      try
+      {
+        // Filename carries a space AND a shell-injection payload. A filename cannot contain '/',
+        // so the injected command targets the (deterministic) CWD, not an absolute path.
+        string binaryPath = Path.Combine(work, "bs local; touch pwned; #");
+        File.WriteAllText(binaryPath, "#!/bin/sh\n"); // default perms ~0644 (not executable)
+
+        tunnel = new TunnelClass();
+        ((TunnelClass)tunnel).setBinaryAbsolute(binaryPath);
+        tunnel.modifyBinaryPermission();
+
+        Assert.IsFalse(File.Exists(Path.Combine(work, "pwned")),
+          "shell metacharacters in binaryAbsolute were interpreted - OS command injection");
+        Assert.IsTrue(IsExecutable(binaryPath),
+          "chmod 0755 was not applied to the real binary path (the path was mangled by the shell)");
+      }
+      finally
+      {
+        Directory.SetCurrentDirectory(prevCwd);
+        try { Directory.Delete(work, true); } catch { }
+      }
+    }
+
+    // Returns true iff `path` has the execute bit set. Uses sh's `$0` positional so the
+    // path (which contains a space + metacharacters) is passed safely, not re-parsed.
+    private static bool IsExecutable(string path)
+    {
+      var psi = new System.Diagnostics.ProcessStartInfo("/bin/sh") { UseShellExecute = false };
+      psi.ArgumentList.Add("-c");
+      psi.ArgumentList.Add("test -x \"$0\"");
+      psi.ArgumentList.Add(path);
+      using (var p = System.Diagnostics.Process.Start(psi))
+      {
+        p.WaitForExit();
+        return p.ExitCode == 0;
+      }
+    }
     public class TunnelClass : BrowserStackTunnel
     {
       public TunnelClass() : base("test-user-agent") {}
+      // Stub the network boundary so these binary-path/fallback unit tests exercise
+      // the real path-resolution logic without making a live HTTP call to the
+      // endpoint API (which addBinaryPath triggers on first invocation).
+      protected override string fetchSourceUrl(string accessKey)
+      {
+        return null;
+      }
       public StringBuilder getOutputBuilder()
       {
         return output;
@@ -141,10 +207,14 @@ public string getBinaryAbsolute()
       {
         return binaryAbsolute;
       }
-      public string getBinaryArguments()
+      public List<string> getBinaryArguments()
       {
         return binaryArguments;
       }
+      public void setBinaryAbsolute(string path)
+      {
+        binaryAbsolute = path;
+      }
     }
   }
 }