Potential fix for code scanning alert no. 5: Unvalidated dynamic method call

[ialejandro]

Potential fix for https://github.com/devops-ia/self-learning-platform/security/code-scanning/5

In general, to fix unvalidated dynamic method calls, you must ensure that the property name derived from user input is only used to access a vetted set of callable functions. This usually means (a) checking that the name is in a whitelist or Map, (b) confirming the property is an own property (not coming from the prototype chain), and (c) verifying that the retrieved value is a function before calling it. If any check fails, you should handle it gracefully instead of calling the value.

For this specific code, the best minimally invasive fix is to add explicit validation around the dynamic lookups and invocations:

1. For the exact match on line 26–27:

   • Compute const handler = exercise.terminalCommands[trimmedCommand].
   • Check that Object.prototype.hasOwnProperty.call(exercise.terminalCommands, trimmedCommand) is true, and that typeof handler === "function".
   • Only then call handler(currentCode).
   • Otherwise, fall through to the rest of the logic so that unknown commands are handled by the later built‑in or “command not found” logic.

2. For the prefix matching loop on lines 31–34:

   • Since Object.entries returns own enumerable properties as [pattern, handler], we already avoid prototype chain issues, but we still must ensure that handler is a function.
   • Add if (typeof handler !== "function") { continue; } before invoking it.
   • Keep the prefix matching logic unchanged apart from this validation.

No new imports are needed; we can use Object.prototype.hasOwnProperty.call directly. All changes are confined to src/lib/terminal/simulator.ts within the executeCommand function.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

In general, to fix unvalidated dynamic method calls you must (a) restrict which methods can be called (whitelisting / own-property checks), (b) ensure the resolved property is actually a function before invoking it, and (c) handle any exceptions thrown by those dynamically selected handlers so that they cannot cause an unhandled runtime error or denial of service.

In this code, (a) and (b) are already in place: the exact-match lookup uses hasOwnProperty and a type check, and the prefix loop checks typeof handler === "function". The remaining improvement is to make the dynamic call itself safe by surrounding it with a try/catch so that if a handler throws, the error is translated into a controlled TerminalResponse instead of bubbling up and potentially taking down the request handler. This also helps satisfy CodeQL, which is worried about an exception stemming from a user-controlled dispatch. Concretely, in src/lib/terminal/simulator.ts we should:

• Wrap exactHandler(currentCode) in a try/catch that returns a friendly error response (for example, using t.terminal.commandError if available, or a generic message) and an appropriate non-zero exit code.
• Similarly, wrap handler(currentCode) inside the loop in a try/catch with the same behavior.
• Keep all existing behavior intact when handlers execute successfully.

No new imports are required; we just add the try/catch blocks around the existing calls in executeCommand.

---

[github-actions]

🎉 This PR is included in version 1.1.1 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀