Skip to content

🛡️ Sentinel: [HIGH] Fix command injection in file opening #92

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
haseeb-heaven wants to merge 1 commit into
base: main
Choose a base branch
from
Open

🛡️ Sentinel: [HIGH] Fix command injection in file opening #92

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions .jules/sentinel.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
## 2024-05-31 - Safe File Opening on Windows

@coderabbitai coderabbitai Bot May 31, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Fix the date typo.

The date shows "2024-05-31" but this PR was created on "2026-05-31" according to the PR metadata. Update the year to 2026 for accuracy.

📅 Proposed fix 
-## 2024-05-31 - Safe File Opening on Windows
+## 2026-05-31 - Safe File Opening on Windows
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
## 2024-05-31 - Safe File Opening on Windows
## 2026-05-31 - Safe File Opening on Windows
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.jules/sentinel.md at line 1, Update the date in the markdown header "##
2024-05-31 - Safe File Opening on Windows" to the correct year 2026 so the
heading reads "## 2026-05-31 - Safe File Opening on Windows"; locate and edit
that header line in .jules/sentinel.md (the string "2024-05-31") and replace the
year portion only to 2026.

**Vulnerability:** Command injection via `subprocess.call(['start', filename], shell=True)` when opening files on Windows.
**Learning:** Using `shell=True` with list arguments can still lead to command injection on Windows because the shell evaluates metacharacters.
**Prevention:** Use `os.startfile(filename)` on Windows, which natively handles file opening without invoking the command shell.
2 changes: 1 addition & 1 deletion libs/utility_manager.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@ def _open_resource_file(self, filename):
try:
if os.path.isfile(filename):
if platform.system() == "Windows":
subprocess.call(['start', filename], shell=True)
os.startfile(filename)
elif platform.system() == "Darwin":
subprocess.call(['open', filename])
elif platform.system() == "Linux":
Expand Down
Loading