Security: Python subprocess spawned without shell=True but no input validation, vulnerable to code injection via script names

[anshul23102]

Problem

Python backend spawned from Electron main.js without validating script inputs. Shell scripts with malicious names or content could be executed.

---

Technical Details

File: main.js
Line: 2

const { spawn } = require('child_process');

Script execution via /api/scripts/run endpoint may not validate script paths.

---

Recommended Solution

Validate script paths before execution:

const path = require('path');
const fs = require('fs');

function validateScriptPath(scriptPath) {
  const resolved = path.resolve(scriptPath);
  const allowed = path.resolve(__dirname, 'scripts');
  
  if (!resolved.startsWith(allowed)) {
    throw new Error('Access denied: path outside allowed directory');
  }
  
  if (!fs.existsSync(resolved)) {
    throw new Error('Script not found');
  }
  
  return resolved;
}

---

Program Template

• GSSoC '26

---

Suggested Labels

security, command-injection, subprocess, gssoc-eligible
EOF
)

[anshul23102]

@siddu-k Contributing under GSSoC '26. This prevents command injection by validating script paths. Request assignment under GSSoC '26. 🔐