Conversation
AI CostNo spend detected for branch Updated 2026-09-23T13:47Z · last 30 days · data from Requesty |
![aikido-pr-checks[bot]](https://avatars.githubusercontent.com/in/898896?s=60&v=4){kind=small}
| var cmd *exec.Cmd | ||
| switch runtime.GOOS { | ||
| case "darwin": | ||
| cmd = exec.Command("open", url) |
There was a problem hiding this comment.
Possible command injection via shell script - medium severity
Your code spawns a subprocess via a shell script. User input could be abused to inject extra commands.
Show fix
Remediation: This issue can be mitigated or ignored if you verified or sanitized the user input used in the shell command.
Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info
| case "darwin": | ||
| cmd = exec.Command("open", url) | ||
| case "windows": | ||
| cmd = exec.Command("rundll32", "url.dll,FileProtocolHandler", url) |
There was a problem hiding this comment.
Possible command injection via shell script - medium severity
Your code spawns a subprocess via a shell script. User input could be abused to inject extra commands.
Show fix
Remediation: This issue can be mitigated or ignored if you verified or sanitized the user input used in the shell command.
Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info
| case "windows": | ||
| cmd = exec.Command("rundll32", "url.dll,FileProtocolHandler", url) | ||
| default: | ||
| cmd = exec.Command("xdg-open", url) |
There was a problem hiding this comment.
Possible command injection via shell script - medium severity
Your code spawns a subprocess via a shell script. User input could be abused to inject extra commands.
Show fix
Remediation: This issue can be mitigated or ignored if you verified or sanitized the user input used in the shell command.
Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info
| "os" | ||
| "os/exec" | ||
| ) | ||
|
|
||
| // execProcess runs the harness as a child with our terminal and exits with | ||
| // its status once it finishes. Windows has no exec(2), so this is the closest | ||
| // equivalent. It is a variable so tests can capture the launch instead. | ||
| var execProcess = func(path string, argv []string, env []string) error { | ||
| cmd := exec.Command(path, argv[1:]...) |
There was a problem hiding this comment.
Possible command injection via shell script - medium severity
Your code spawns a subprocess via a shell script. User input could be abused to inject extra commands.
Show fix
| "os" | |
| "os/exec" | |
| ) | |
| // execProcess runs the harness as a child with our terminal and exits with | |
| // its status once it finishes. Windows has no exec(2), so this is the closest | |
| // equivalent. It is a variable so tests can capture the launch instead. | |
| var execProcess = func(path string, argv []string, env []string) error { | |
| cmd := exec.Command(path, argv[1:]...) | |
| "fmt" | |
| "os" | |
| "os/exec" | |
| "regexp" | |
| ) | |
| // execProcess runs the harness as a child with our terminal and exits with | |
| // its status once it finishes. Windows has no exec(2), so this is the closest | |
| // equivalent. It is a variable so tests can capture the launch instead. | |
| var execProcess = func(path string, argv []string, env []string) error { | |
| validPath := regexp.MustCompile(`^[a-zA-Z0-9_\-\.\/\\\: ]+$`) | |
| if !validPath.MatchString(path) { | |
| return fmt.Errorf("invalid input") | |
| } | |
| cmd := exec.Command(path, argv[1:]...) |
Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info
1 participant
No description provided.