vrr/spawn
2
0
Fork 0
mirror of https://github.com/OpenRouterTeam/spawn.git synced 2026-04-28 11:59:29 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 10

fix(security): shell-quote package names in cloud-init scripts (#3220)
Some checks are pending
CLI Release / Build and release CLI (push) Waiting to run
Details
Lint / ShellCheck (push) Waiting to run
Details
Lint / Biome Lint (push) Waiting to run
Details
Lint / macOS Compatibility (push) Waiting to run
Details

Browse source 
Apply shellQuote() to package names interpolated into startup scripts
across all four cloud providers (GCP, AWS, Hetzner, DigitalOcean).
Defense-in-depth against supply chain attacks where compromised package
lists could inject shell metacharacters into root cloud-init scripts.

Fixes #3216

Agent: security-auditor

Co-authored-by: B <6723574+louisgv@users.noreply.github.com>
Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
This commit is contained in:
A 2026-04-07 01:35:44 -07:00 • committed by GitHub
parent aad03f3b1b
commit 0fe16d3ffc
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
4 changed files with 8 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

3
packages/cli/src/hetzner/hetzner.ts
View file

@ -304,6 +304,7 @@ export async function ensureSshKey(): Promise<void> {
function getCloudInitUserdata(tier: CloudInitTier = "full"): string {
const packages = getPackagesForTier(tier);
const quotedPackages = packages.map((p) => shellQuote(p)).join(" ");
const lines = [
"#!/bin/bash",
"export HOME=/root",
@ -311,7 +312,7 @@ function getCloudInitUserdata(tier: CloudInitTier = "full"): string {
"# Guarantee the cloud-init marker is written on exit (success, failure, or signal)",
"trap 'touch /home/ubuntu/.cloud-init-complete 2>/dev/null; touch /root/.cloud-init-complete' EXIT",
"apt-get update -y || true",
`apt-get install -y --no-install-recommends ${packages.join(" ")} || true`,
`apt-get install -y --no-install-recommends ${quotedPackages} || true`,
];
if (needsNode(tier)) {
lines.push(`${NODE_INSTALL_CMD} || true`);