🛡️ Sentinel: [CRITICAL] Fix RCE in Rhai shell_execute#33
🛡️ Sentinel: [CRITICAL] Fix RCE in Rhai shell_execute#33JustinWoodring wants to merge 1 commit intomainfrom
Conversation
…uments - Implemented an allowlist for `shell_execute` in `slatron-server` (allowed: `yt-dlp`, `ffmpeg`, `ffprobe`). - Added strict argument checking for `yt-dlp` to block `--exec` variants, preventing RCE. - Added regression and security tests in `slatron-server/src/rhai_engine/security_test.rs`. - Documented findings in `.jules/sentinel.md`. Co-authored-by: JustinWoodring <41842051+JustinWoodring@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
1 participant
🛡️ Sentinel: [CRITICAL] Fix RCE in Rhai shell_execute
🚨 Severity: CRITICAL
💡 Vulnerability: The
shell_executefunction inslatron-serverallowed arbitrary command execution. This could allow an attacker with script editing privileges to execute any command on the server.🎯 Impact: Full server compromise via RCE.
🔧 Fix:
shell_executeto a strict allowlist:yt-dlp,ffmpeg,ffprobe.yt-dlpto block--execand related flags, preventing command injection bypasses.✅ Verification:
test_shell_execute_arbitrary_commandto verify arbitrary commands (e.g.,echo) are blocked.test_shell_execute_ytdlp_exec_blockedto verifyyt-dlp --execis blocked.yt-dlp --version) is still allowed.PR created automatically by Jules for task 4930606936570814363 started by @JustinWoodring