Skip to content

[Security] Harden cloudflared installation against command injection#7842

Draft
gonzaloriestra wants to merge 2 commits into
mainfrom
security-harden-cloudflared-install-5314096495162801865
Draft

[Security] Harden cloudflared installation against command injection#7842
gonzaloriestra wants to merge 2 commits into
mainfrom
security-harden-cloudflared-install-5314096495162801865

Conversation

@gonzaloriestra

@gonzaloriestra gonzaloriestra commented Jun 17, 2026

Copy link
Copy Markdown
Contributor

WHY are these changes introduced?

Hardens the codebase against a potential command injection vulnerability in the cloudflared installation script.

WHAT is this pull request doing?

Replaces execSync with execFileSync in the macOS installation path for cloudflared. This ensures that the binary path and filename are treated as literal arguments rather than being interpreted by a shell, preventing command injection if a malicious path is provided.

How to test your changes?

CI

Checklist

  • I've considered possible cross-platform impacts (Mac, Linux, Windows)
  • I've considered possible documentation changes
  • I've considered analytics changes to measure impact
  • The change is user-facing — I've identified the correct bump type (patch for bug fixes · minor for new features · major for breaking changes) and added a changeset with pnpm changeset add

PR created automatically by Jules for task 5314096495162801865 started by @gonzaloriestra

@gonzaloriestra
[Security] Harden cloudflared installation against command injection
31a9492 
Replaces execSync with execFileSync in installMacos to prevent command
injection via shell metacharacters in binTarget. Added a regression test
to verify the fix.
@google-labs-jules

google-labs-jules Bot commented Jun 17, 2026

Copy link
Copy Markdown

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

For security, I will only act on instructions from the user who triggered this task.

@github-actions github-actions Bot added the no-changelog This PR doesn't include a changeset entry. Is an internal only change not relevant to end users. label Jun 17, 2026
@gonzaloriestra
[Security] Harden cloudflared installation against command injection
ae8121b 
Replaces execSync with execFileSync in installMacos to prevent command
injection via shell metacharacters in binTarget. Added a regression test
to verify the fix, configured to skip on Windows where shell
metacharacters are invalid in paths.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

no-changelog This PR doesn't include a changeset entry. Is an internal only change not relevant to end users. security

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@gonzaloriestra