fix(security): harden session creation input validation (#104)

## Summary
Adds type validation for `args` and `initialCommand` parameters in
session creation to address CodeQL alert #14 (code injection).

### Changes
- **routes.js**: Validate `args` is an array of strings and
`initialCommand` is a string at the API layer
- **sessions.js**: Defense-in-depth type checks before `pty.spawn()`
- **routes.test.js**: 3 new tests covering invalid `args` (non-array,
mixed types) and non-string `initialCommand`

### Context
CodeQL flags user-provided values flowing into `pty.spawn()` as code
injection. While this is by design (TermBeam is a terminal emulator),
adding type validation prevents unexpected object types from reaching
the PTY layer.

Closes #98

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: dorlugasigal

src/routes.js

@@ -15,15 +15,17 @@ const pageRateLimit = rateLimit({
   max: 120,
   standardHeaders: true,
   legacyHeaders: false,
-  handler: (_req, res) => res.status(429).json({ error: 'Too many requests, please try again later.' }),
+  handler: (_req, res) =>
+    res.status(429).json({ error: 'Too many requests, please try again later.' }),
 });
 
 const apiRateLimit = rateLimit({
   windowMs: 1 * 60 * 1000,
   max: 120,
   standardHeaders: true,
   legacyHeaders: false,
-  handler: (_req, res) => res.status(429).json({ error: 'Too many requests, please try again later.' }),
+  handler: (_req, res) =>
+    res.status(429).json({ error: 'Too many requests, please try again later.' }),
 });
 
 const IMAGE_SIGNATURES = [
@@ -51,7 +53,6 @@ function validateMagicBytes(buffer, contentType) {
 }
 
 function setupRoutes(app, { auth, sessions, config, state }) {
-
   // Serve static files (manifest.json, sw.js, icons, etc.)
   app.use(express.static(PUBLIC_DIR, { index: false }));
 
@@ -143,6 +144,20 @@ function setupRoutes(app, { auth, sessions, config, state }) {
       }
     }
 
+    // Validate args field — must be an array of strings
+    if (shellArgs !== undefined) {
+      if (!Array.isArray(shellArgs) || !shellArgs.every((a) => typeof a === 'string')) {
+        return res.status(400).json({ error: 'args must be an array of strings' });
+      }
+    }
+
+    // Validate initialCommand field — must be a string
+    if (initialCommand !== undefined && initialCommand !== null) {
+      if (typeof initialCommand !== 'string') {
+        return res.status(400).json({ error: 'initialCommand must be a string' });
+      }
+    }
+
     // Validate cwd field
     if (cwd) {
       if (!path.isAbsolute(cwd)) {
@@ -164,7 +179,7 @@ function setupRoutes(app, { auth, sessions, config, state }) {
         shell: shell || config.defaultShell,
         args: shellArgs || [],
         cwd: cwd ? path.resolve(cwd) : config.cwd,
-        initialCommand: initialCommand || null,
+        initialCommand: initialCommand ?? null,
         color: color || null,
         cols: typeof cols === 'number' && cols > 0 && cols <= 500 ? Math.floor(cols) : undefined,
         rows: typeof rows === 'number' && rows > 0 && rows <= 200 ? Math.floor(rows) : undefined,

src/sessions.js

@@ -6,7 +6,6 @@ const pty = require('node-pty');
 const log = require('./logger');
 const { getGitInfo } = require('./git');
 
-
 function _getProcessCwd(pid) {
   try {
     if (process.platform === 'linux') {
@@ -111,12 +110,23 @@ class SessionManager {
     rows = 30,
   }) {
     // Defense-in-depth: reject shells with dangerous characters or relative paths
-    if (typeof shell !== 'string' || !shell ||
-        /[;&|`$(){}\[\]!#~]/.test(shell) ||
-        (!path.isAbsolute(shell) && !shell.match(/^[a-zA-Z0-9._-]+(\.exe)?$/))) {
+    if (
+      typeof shell !== 'string' ||
+      !shell ||
+      /[;&|`$(){}\[\]!#~]/.test(shell) ||
+      (!path.isAbsolute(shell) && !shell.match(/^[a-zA-Z0-9._-]+(\.exe)?$/))
+    ) {
       throw new Error('Invalid shell');
     }
 
+    // Defense-in-depth: validate args and initialCommand types
+    if (!Array.isArray(args) || !args.every((a) => typeof a === 'string')) {
+      throw new Error('args must be an array of strings');
+    }
+    if (initialCommand !== null && typeof initialCommand !== 'string') {
+      throw new Error('initialCommand must be a string');
+    }
+
     const id = crypto.randomBytes(16).toString('hex');
     if (!color) {
       color = SESSION_COLORS[this.sessions.size % SESSION_COLORS.length];

test/routes.test.js

@@ -505,6 +505,69 @@ describe('Routes', () => {
       assert.strictEqual(data.error, 'cwd does not exist');
     });
 
+    it('should reject non-array args with 400', async () => {
+      if (!inst) inst = await startServer();
+      const body = JSON.stringify({ args: 'not-an-array' });
+      const res = await httpRequest(
+        {
+          hostname: '127.0.0.1',
+          port: inst.port,
+          path: '/api/sessions',
+          method: 'POST',
+          headers: {
+            'Content-Type': 'application/json',
+            'Content-Length': Buffer.byteLength(body),
+          },
+        },
+        body,
+      );
+      assert.strictEqual(res.statusCode, 400);
+      const data = JSON.parse(res.data);
+      assert.strictEqual(data.error, 'args must be an array of strings');
+    });
+
+    it('should reject args with non-string elements with 400', async () => {
+      if (!inst) inst = await startServer();
+      const body = JSON.stringify({ args: ['valid', 123] });
+      const res = await httpRequest(
+        {
+          hostname: '127.0.0.1',
+          port: inst.port,
+          path: '/api/sessions',
+          method: 'POST',
+          headers: {
+            'Content-Type': 'application/json',
+            'Content-Length': Buffer.byteLength(body),
+          },
+        },
+        body,
+      );
+      assert.strictEqual(res.statusCode, 400);
+      const data = JSON.parse(res.data);
+      assert.strictEqual(data.error, 'args must be an array of strings');
+    });
+
+    it('should reject non-string initialCommand with 400', async () => {
+      if (!inst) inst = await startServer();
+      const body = JSON.stringify({ initialCommand: 12345 });
+      const res = await httpRequest(
+        {
+          hostname: '127.0.0.1',
+          port: inst.port,
+          path: '/api/sessions',
+          method: 'POST',
+          headers: {
+            'Content-Type': 'application/json',
+            'Content-Length': Buffer.byteLength(body),
+          },
+        },
+        body,
+      );
+      assert.strictEqual(res.statusCode, 400);
+      const data = JSON.parse(res.data);
+      assert.strictEqual(data.error, 'initialCommand must be a string');
+    });
+
     it('should create session with valid data', async () => {
       if (!inst) inst = await startServer();
       const body = JSON.stringify({ name: 'Valid Session' });