Skip to content

Add ICommandRunner for safe cross-platform process execution #288

Description

@JusterZhu

Summary

Add a process execution abstraction to eliminate direct Process.Start calls and their associated command injection risks.

Changes

  • ICommandRunner: interface for cross-platform command execution with argument list support
  • CommandRunner: safe Process wrapper using ArgumentList (no shell parsing, no injection risk)
  • CommandResult: structured result with exit code, stdout, stderr
  • Migrate WindowsGeneralDrivelution PnPUtil calls to use ICommandRunner
  • Migrate LinuxGeneralDrivelution insmod/modprobe/dpkg/rpm calls to use ICommandRunner
  • Constructor injection: both Windows and Linux updaters accept ICommandRunner

Why

Current code concatenates arguments as strings which is vulnerable to path injection. The new approach passes each argument separately via ProcessStartInfo.ArgumentList.

Closes #288

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions