Beagle SCM

JS-067 MED: shared/wire.js ssh host argv injection + unquoted DOG_REMOTE_PATH

shared/wire.js's classify() (the upload-pack CLIENT spawn) passes the remote URI host as argv[1] of ssh with no --/leading-dash guard, so a host like -oProxyCommand=… is read by ssh as an OPTION → local command exec (the CVE-2017-1000117 class). The command body is shQuoted but the host is not, and $DOG_REMOTE_PATH is interpolated UNQUOTED into the remote shell string. Native single-quotes it. Realistic vector: a user/script-supplied be get <uri>. Method: Issues.

Input

Context

• shared/wire.js:33 host = u.host || u.authority || "" — straight from the

  URI, never validated.

• :65 ssh-keeper spawn argv: [sshBin, host, cmd] — host is argv[1],

  so be://-oProxyCommand=touch%20pwned/… makes ssh exec a local command.

• :68 vanilla-git spawn argv: [sshBin, host, "git-"+verb+" "+shq(path)]

  — same unguarded host (body shq'd, host not).

• :61 remPath = io.getenv("DOG_REMOTE_PATH") || "".
• :63 cmd = "PATH="+remPath+":$PATH exec keeper "+verb+" "+shq(sp) —

  remPath is concatenated RAW into the remote shell line (sp is shq'd), so a space/;/$() in DOG_REMOTE_PATH injects remote commands; native single-quotes it.

• Entry: fetch() :135-136 classify(remoteUri,…)→io.spawn(sp.bin,sp.argv)

  on the user-supplied be get <uri> (cited GET).

Goals

• Reject (or neutralize) a host that ssh would read as an option, so

  be get be://-oProxyCommand=…/p cannot exec a local command.

• $DOG_REMOTE_PATH is shell-quoted in the remote cmd exactly like native,

  so a hostile value cannot inject remote commands.

• Repro tests asserting the spawned argv for both vectors.

Constraints

• Mirror keeper/WIRECLI.c wcli_spawn transport classify; keep the

  file/keeper-local/ssh-keeper/vanilla-git branches and serve-path rules.

• Pure JS over io.spawn+pkt.js; reuse the existing shQuote

  (../view/render.js). Scope: classify() only.

WIP

Design decisions

• Validate host as [user@]host: reject a leading - (and bare /); or, if

  parity needs odd hosts, insert a -- end-of-options marker before host in the ssh argv so ssh stops option parsing.

• shQuote(remPath) before splicing into cmd (single-quote like native);

  keep the no-DOG_REMOTE_PATH branch byte-identical.

TODOs

• Repro-first test/js/wire/*: classify("be://-oProxyCommand=x/p",…)

  asserts the host is rejected (or ---guarded), NOT placed as a bare ssh option; and DOG_REMOTE_PATH="x; touch pwn" asserts a quoted cmd.

• Add the host guard + shQuote(remPath) in classify().

Blockers and bummers

• Confirm native's exact host-acceptance set so the guard keeps parity.

• 2026-07-07 audit: STILL OPEN (line refs shifted; classify reworked by URI-015/DIS-058).

  shared/wire.js:37 host = u.host||u.authority||"" unvalidated; ssh spawn :88 argv:[sshBin, dest, cmd] with dest (:78 user@host|host) unguarded for a leading -; :84 remPath= getenv("DOG_REMOTE_PATH") spliced RAW :86 "PATH="+remPath+":$PATH exec keeper "+shq(sp).

Outcome

• (pending)