From a00997a9bc3781a227640607b19bba17c3195f31 Mon Sep 17 00:00:00 2001 From: Charlie Vieth Date: Wed, 8 Jul 2026 15:18:49 -0400 Subject: [PATCH] Fix command injection in entrypoint argument handling Replace `sh -c "porter $INPUT_COMMAND"` with `exec porter $INPUT_COMMAND`. The old form re-parsed the input as a shell script, so metacharacters (; | && $() backticks) in INPUT_COMMAND were executed. Direct unquoted expansion still word-splits into multiple args/flags but passes them to porter as literal argument text, closing the injection hole. Using exec also avoids the extra subshell so signals and exit codes propagate cleanly. Co-Authored-By: Claude Opus 4.8 (1M context) Claude-Session: https://claude.ai/code/session_01XJ6dDbHQymBQw7zpXY64LS --- entrypoint.sh | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/entrypoint.sh b/entrypoint.sh index bb501e6..a530cfe 100755 --- a/entrypoint.sh +++ b/entrypoint.sh @@ -2,4 +2,6 @@ : "${INPUT_COMMAND:?input \"command\" not set or empty}" -/bin/sh -c "porter $INPUT_COMMAND" \ No newline at end of file +# Intentional word splitting. +# shellcheck disable=SC2086 +exec porter $INPUT_COMMAND