From e69de710b5c752c58e20a77c876de71f9402409b Mon Sep 17 00:00:00 2001
From: devdudumuniz <82589615+devdudumuniz@users.noreply.github.com>
Date: Sat, 29 Aug 2026 21:30:29 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[HIGH]=20Fi?=
 =?UTF-8?q?x=20command=20injection=20in=20directory=20picker?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

🚨 Severity: HIGH
💡 Vulnerability: Command injection in `_native_dir_picker` due to unescaped user inputs (`title` and `initialdir`) being directly interpolated into PowerShell and AppleScript strings.
🎯 Impact: A malicious user could provide crafted input strings that break out of the string literal and execute arbitrary commands on the host machine.
🔧 Fix: Added proper escaping for single quotes in PowerShell (`''`) and double quotes/backslashes in AppleScript (`\"` and `\\`).
✅ Verification: Ran `pytest pysus/tests/` to ensure no regressions. Verified locally that payload execution is stopped and tests pass.
---
 .jules/sentinel.md          |  7 +++++++
 pysus/web/pages/1_client.py | 12 +++++++++---
 2 files changed, 16 insertions(+), 3 deletions(-)
 create mode 100644 .jules/sentinel.md

diff --git a/.jules/sentinel.md b/.jules/sentinel.md
new file mode 100644
index 00000000..7247f35b
--- /dev/null
+++ b/.jules/sentinel.md
@@ -0,0 +1,7 @@
+## 2024-08-29 - Command Injection in Native Directory Picker
+
+**Vulnerability:** A command injection vulnerability existed in `pysus/web/pages/1_client.py` within the `_native_dir_picker` function. When opening a directory picker on Windows or macOS (Darwin), user-provided strings (`title` and `initialdir`) were directly formatted into PowerShell and AppleScript strings without any escaping.
+
+**Learning:** When using Python's `subprocess.run` to execute scripts that dynamically construct logic via format strings (f-strings) inside platforms like PowerShell or `osascript`, quoting strings within those formats is insufficient if the external platform is processing the final string payload. Even though `shell=True` was not used, the script engines evaluated the unescaped inputs as code.
+
+**Prevention:** Always escape data embedded inside dynamically generated scripts being passed to an interpreter like PowerShell (`'` to `''`) or AppleScript (`\` to `\\`, `"` to `\"`), or pass the data as parameters/arguments to the script rather than embedding them directly in the script source.
diff --git a/pysus/web/pages/1_client.py b/pysus/web/pages/1_client.py
index fd5cfdb5..454bb283 100644
--- a/pysus/web/pages/1_client.py
+++ b/pysus/web/pages/1_client.py
@@ -726,11 +726,14 @@ def _native_dir_picker(title: str, initialdir: str) -> str:
                 continue
 
     elif system == "Windows":
+        # Escape single quotes for PowerShell string literals
+        title_esc = title.replace("'", "''")
+        initialdir_esc = initialdir.replace("'", "''")
         ps = f"""
 Add-Type -AssemblyName System.Windows.Forms
 $f = New-Object System.Windows.Forms.FolderBrowserDialog
-$f.Description = '{title}'
-$f.SelectedPath = '{initialdir}'
+$f.Description = '{title_esc}'
+$f.SelectedPath = '{initialdir_esc}'
 $f.ShowDialog() | Out-Null
 $f.SelectedPath
 """
@@ -742,10 +745,13 @@ def _native_dir_picker(title: str, initialdir: str) -> str:
         return r.stdout.strip()
 
     elif system == "Darwin":
+        # Escape backslashes and double quotes for AppleScript string literals
+        title_esc = title.replace("\\", "\\\\").replace('"', '\\"')
+        initialdir_esc = initialdir.replace("\\", "\\\\").replace('"', '\\"')
         prompt_line = (
             'set f to choose folder with prompt "{}"'
             ' default location POSIX file "{}"'
-        ).format(title, initialdir)
+        ).format(title_esc, initialdir_esc)
         applescript = (
             f'tell application "System Events"\n'
             f"    activate\n"