[anupamme]

The runFetch function executes git commands using execFile with the gitRoot parameter passed directly as a command-line argument. While execFile with array arguments provides some protection against shell injection, the gitRoot parameter flows from user-controlled input via the /api/repo-refresh/trigger endpoint without proper path validation. An attacker could exploit this by providing a malicious gitRoot path containing shell metacharacters or path traversal sequences. The affected code is src/repo-refresh.js:114. This change is the fix I would apply.

Reference: CWE-78

What changed

• src/repo-refresh.js

Verification

No automated check could be run against this repository, so this change is unverified beyond review. Please treat it as a suggestion.

Regression test

The security boundary is maintained under adversarial input

Test

const { runFetch } = require('../src/repo-refresh.js');

describe("runFetch rejects adversarial gitRoot paths to prevent command injection", () => {
  const payloads = [
    // Exploit: shell metacharacters attempting injection
    '; rm -rf /; echo ',
    // Boundary: path traversal
    '../../../etc/passwd',
    // Valid: normal repository path (should work or fail gracefully, not execute)
    '/tmp/valid-repo',
  ];

  test.each(payloads)("rejects adversarial input: %s", async (payload) => {
    // Security invariant: adversarial paths must not cause command execution
    // The function should either reject invalid paths or fail safely
    await expect(runFetch(payload)).rejects.toThrow();
  });
});

---

Automated security fix by OrbisAI Security