David Gageot 24d947c2da fix: prevent PATH hijacking and TOCTOU in shell/binary resolution (CWE-426) ...

Introduce pkg/shellpath to centralize safe shell binary resolution:
- WindowsCmdExe() resolves cmd.exe via ComSpec or %SystemRoot%\System32
  instead of bare PATH lookup
- DetectShell()/DetectWindowsShell() use exec.LookPath (absolute paths)
  for PowerShell, falling back to WindowsCmdExe()

Replace vulnerable bare cmd.exe resolution in three critical locations:
- pkg/tools/builtin/shell.go (detectShell)
- pkg/hooks/executor.go (initShell)
- pkg/tui/handlers.go (startShell)

Fix TOCTOU race in credential providers:
- lookupBinary() now returns the resolved absolute path
- KeychainProvider and PassProvider store and reuse the resolved path
  instead of re-resolving bare binary names at invocation time

Assisted-By: docker-agent

2026-03-12 13:25:39 +01:00

..

shellpath_test.go

fix: prevent PATH hijacking and TOCTOU in shell/binary resolution (CWE-426)

2026-03-12 13:25:39 +01:00

shellpath.go

fix: prevent PATH hijacking and TOCTOU in shell/binary resolution (CWE-426)

2026-03-12 13:25:39 +01:00