torrentclaw/torrentclaw-skill
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(security): eliminate shell injection and add input validation

Browse source 
Replace unsafe string interpolation in aria2 RPC JSON construction
with jq --arg for proper escaping. Add magnet URL format validation
to reject arbitrary input. Refactor detect-client.sh JSON output
to use jq. Add CI security check to prevent regression.

Resolves VirusTotal "Suspicious" classification caused by the
shell injection vulnerability in add-torrent.sh.
This commit is contained in:
Deivid Soto 2026-02-15 10:46:34 +01:00
parent 5d409c4a66
commit d3d6c702ed
6 changed files with 73 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

10
CHANGELOG.md
View file

@ -2,6 +2,16 @@
All notable changes to this project will be documented in this file.
## [0.1.16] - 2026-02-14
### Security
- Fix shell injection vulnerability in aria2 RPC JSON construction (add-torrent.sh)
- Add magnet URL format validation before passing to torrent clients
- Replace shell string interpolation with `jq --arg` for safe JSON construction
- Refactor detect-client.sh JSON output to use `jq` instead of heredoc interpolation
- Add CI security pattern check to prevent unsafe curl payload regression
## [0.1.13] - 2026-02-13
### Features