From b9b3ec6a6380829713056e128b915322fa44fa1e Mon Sep 17 00:00:00 2001 From: Sparsh Date: Tue, 19 May 2026 00:58:09 +0530 Subject: [PATCH] fix(security): resolve CodeQL findings in package.mjs build script TOCTOU (CWE-367): fs.statSync(entry.from).isDirectory() was called before mirrorDirectory/cpSync without error handling. If the path disappears between stat and use, the subsequent operation throws unhandled. Wrap in try/catch and continue on error. Indirect uncontrolled command line (CWE-78): appBuilderLibVersion is read from desktopPackageLock (an external file) and embedded directly in an npm pack CLI argument. Validate it matches a semver pattern before use to prevent injection via a compromised lockfile. --- gitnexus-desktop/scripts/package.mjs | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/gitnexus-desktop/scripts/package.mjs b/gitnexus-desktop/scripts/package.mjs index e1f036f4d..996a7f364 100644 --- a/gitnexus-desktop/scripts/package.mjs +++ b/gitnexus-desktop/scripts/package.mjs @@ -36,6 +36,12 @@ const requiredBuilderRuntimeModules = ['app-builder-bin']; const appBuilderLibVersion = desktopPackageLock.packages?.['node_modules/app-builder-lib']?.version ?? electronBuilderVersion.replace(/^[^\d]*/, ''); +// Validate version is safe semver before embedding in a CLI argument. +if (!/^\d+\.\d+\.\d+(?:[.-][a-zA-Z0-9._-]*)?$/.test(appBuilderLibVersion)) { + throw new Error( + `Invalid app-builder-lib version in lockfile: ${JSON.stringify(appBuilderLibVersion)}`, + ); +} const stamp = new Date().toISOString().replace(/[:.]/g, '-'); const outputDir = path.join(releaseRoot, stamp); const latestReleasePointerPath = path.join(releaseRoot, '.latest-unpacked-release'); @@ -279,7 +285,14 @@ const syncPackagedRuntimeResources = () => { for (const entry of packagedResourceEntries) { const destinationPath = path.join(resourceRoot, entry.to); - if (fs.statSync(entry.from).isDirectory()) { + let isDirectory; + try { + isDirectory = fs.statSync(entry.from).isDirectory(); + } catch (err) { + if (err.code !== 'ENOENT') throw err; + continue; + } + if (isDirectory) { mirrorDirectory(entry.from, destinationPath); continue; }