fix: sanitize child_process call in discord-release-notify.js...

[anupamme]

Summary

Address high severity security finding in scripts/discord-release-notify.js.

Vulnerability

Field	Value
ID	javascript.lang.security.detect-child-process.detect-child-process
Severity	HIGH
Scanner	semgrep
Rule	javascript.lang.security.detect-child-process.detect-child-process
File	scripts/discord-release-notify.js:31
Assessment	Pattern match — needs manual review

Description: Detected calls to child_process from a function argument version. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed.

Evidence

Scanner confirmation: semgrep rule javascript.lang.security.detect-child-process.detect-child-process matched this pattern as javascript.lang.security.detect-child-process.detect-child-process.

Threat Model Context

This is a Node.js library - vulnerabilities affect downstream consumers who use this package.

Changes

• scripts/discord-release-notify.js

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

This change addresses a pattern flagged by static analysis. The code path handles user-influenced input and the fix reduces the attack surface against both manual and automated exploitation.

---

Automated security fix by OrbisAI Security

[greptile-apps]

Greptile Summary

This PR updates the Discord release notification script to avoid shell interpolation. The main changes are:

• Replaces execSync with execFileSync for gh release view.
• Passes the release version as a separate command argument.
• Preserves the existing release-note cleanup and Discord webhook payload flow.

Confidence Score: 5/5

Safe to merge with minimal risk.

The change removes shell interpolation for the user-influenced release version while keeping the existing behavior intact.

No files require special attention.

T-Rex Logs

What T-Rex did

• Validated that the gh argv used for the release view contains the version string literally, not executed.
• Reviewed the Discord webhook request capture and confirmed the JSON payload included the literal version and stub release notes in an embedded message.
• Verified the sentinel check reports no shell execution by showing sentinel_absent=true.

_{Ran code and verified through T-Rex}

Important Files Changed

Filename	Overview
scripts/discord-release-notify.js	Replaces shell command execution with argument-vector execFileSync for GitHub release note lookup.

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
  participant CLI as Release script
  participant GH as gh CLI
  participant Discord as Discord webhook

  CLI->>CLI: Read version and optional notes
  alt Notes not provided
    CLI->>GH: execFileSync('gh', ['release','view', version, ...])
    GH-->>CLI: Release body
  end
  CLI->>CLI: Clean and truncate notes
  CLI->>Discord: POST release embed payload
  Discord-->>CLI: HTTP response

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
  participant CLI as Release script
  participant GH as gh CLI
  participant Discord as Discord webhook

  CLI->>CLI: Read version and optional notes
  alt Notes not provided
    CLI->>GH: execFileSync('gh', ['release','view', version, ...])
    GH-->>CLI: Release body
  end
  CLI->>CLI: Clean and truncate notes
  CLI->>Discord: POST release embed payload
  Discord-->>CLI: HTTP response

Loading

_{Reviews (1): Last reviewed commit: "fix: javascript.lang.security.detect-chi..." | Re-trigger Greptile}