-
Notifications
You must be signed in to change notification settings - Fork 0
Security
Keys edited this page Jul 31, 2026
·
1 revision
shell.js reduces what shell input can reach, but it is not a sandbox for arbitrary JavaScript.
| Input | Treatment |
|---|---|
| Shell command text | Parsed without eval; bounded by source, token, command, runtime, and output limits |
| Paths and redirects | Resolved inside MemoryFS; no host filesystem access |
| Built-in commands | No host processes or implicit network commands |
| Custom handlers | Trusted host-page code with the capabilities the application gives them |
| Manual packs | Build-time pinned and hashed; runtime indexes and paths are validated and size-limited |
| WebAssembly | Optional, ABI-checked, and best self-hosted or version-pinned |
Timeouts can stop awaiting a handler, but JavaScript cannot preempt synchronous
work already running. Custom handlers should remain bounded and honor the
provided AbortSignal when they perform asynchronous work.
The supplied DOM adapter writes output with textContent. A custom UI must
preserve that rule or perform its own strict sanitization.
- Set a Content Security Policy suitable for the host application.
- Keep untrusted command implementations outside the page, or isolate them in a stronger boundary such as a Worker or separate origin.
- Configure tighter shell and filesystem limits when the default ceilings are larger than the application needs.
- Treat remote manual packs and Wasm URLs as supply-chain inputs; pin or self-host them.
- Do not present an OS profile as a real FreeBSD or Linux security boundary.
Supported releases receive fixes on the latest major line. Report suspected vulnerabilities through a private GitHub security advisory with affected versions, impact, and reproduction steps. Do not open a public issue before a fix is available.