19e74b4a1b
Closes #18 All six Command::new call sites audited: - bitwarden.rs (sh -c): shell string is a hardcoded literal; no user data. - bitwarden.rs (bw unlock): all args hardcoded. - bitwarden.rs (bw get): item_name and session passed as discrete .args() elements; no shell. - nothooks/runner.rs (nu/sh/etc): interp and script path passed as discrete args; no shell. - notstrap/repo.rs (git clone): url and dest passed as discrete .arg() calls; no shell. - notfiles/tests/integration.rs: test harness with hardcoded args only. Added SAFETY comments on the three sites that handle user-controlled config values.
23 lines
706 B
Rust
23 lines
706 B
Rust
use anyhow::{Context, Result};
|
|
use std::path::Path;
|
|
use std::process::Command;
|
|
|
|
pub fn clone_if_missing(url: &str, dest: &Path) -> Result<bool> {
|
|
if dest.exists() {
|
|
return Ok(false);
|
|
}
|
|
// SAFETY: `url` comes from the notstrap.toml config and `dest` is a `Path` derived from
|
|
// the resolved dotfiles directory. Both are passed as discrete `.arg()` calls with no
|
|
// shell involved, so argument injection is not possible.
|
|
let status = Command::new("git")
|
|
.arg("clone")
|
|
.arg(url)
|
|
.arg(dest)
|
|
.status()
|
|
.context("failed to run git clone")?;
|
|
if !status.success() {
|
|
anyhow::bail!("git clone {} failed", url);
|
|
}
|
|
Ok(true)
|
|
}
|