Beagle SCM

JS-067: shared/wire.js ssh host argv injection + unquoted DOG_REMOTE_PATH

shared/wire.js's classify() (the upload-pack CLIENT spawn) passes the remote URI host as argv[1] of ssh with no --/leading-dash guard, so a host like -oProxyCommand=… is read by ssh as an OPTION → local command exec (the CVE-2017-1000117 class). The command body is shQuoted but the host is not, and $DOG_REMOTE_PATH is interpolated UNQUOTED into the remote shell string. Native single-quotes it. Realistic vector: a user/script-supplied be get <uri>. Method: Issues.

Input

Context

• shared/wire.js:33 host = u.host || u.authority || "" — straight from the URI, never validated.
• :65 ssh-keeper spawn argv: [sshBin, host, cmd] — host is argv[1], so be://-oProxyCommand=touch%20pwned/… makes ssh exec a local command.
• :68 vanilla-git spawn argv: [sshBin, host, "git-"+verb+" "+shq(path)] — same unguarded host (body shq'd, host not).
• :61 remPath = io.getenv("DOG_REMOTE_PATH") || "".
• :63 cmd = "PATH="+remPath+":$PATH exec keeper "+verb+" "+shq(sp) — remPath is concatenated RAW into the remote shell line (sp is shq'd), so a space/;/$() in DOG_REMOTE_PATH injects remote commands; native single-quotes it.
• Entry: fetch() :135-136 classify(remoteUri,…)→io.spawn(sp.bin,sp.argv) on the user-supplied be get <uri> (cited GET).

Goals

• Reject (or neutralize) a host that ssh would read as an option, so be get be://-oProxyCommand=…/p cannot exec a local command.
• $DOG_REMOTE_PATH is shell-quoted in the remote cmd exactly like native, so a hostile value cannot inject remote commands.
• Repro tests asserting the spawned argv for both vectors.

Constraints

• Mirror keeper/WIRECLI.c wcli_spawn transport classify; keep the file/keeper-local/ssh-keeper/vanilla-git branches and serve-path rules.
• Pure JS over io.spawn+pkt.js; reuse the existing shQuote (../view/render.js). Scope: classify() only.

WIP

Design decisions

• Validate host as [user@]host: reject a leading - (and bare /); or, if parity needs odd hosts, insert a -- end-of-options marker before host in the ssh argv so ssh stops option parsing.
• shQuote(remPath) before splicing into cmd (single-quote like native); keep the no-DOG_REMOTE_PATH branch byte-identical.

TODOs

• Repro-first test/js/wire/*: classify("be://-oProxyCommand=x/p",…) asserts the host is rejected (or ---guarded), NOT placed as a bare ssh option; and DOG_REMOTE_PATH="x; touch pwn" asserts a quoted cmd.
• Add the host guard + shQuote(remPath) in classify().

Blockers and bummers

• Confirm native's exact host-acceptance set so the guard keeps parity.

• 2026-07-07 audit: STILL OPEN (line refs shifted; classify reworked by URI-015/DIS-058). shared/wire.js:37 host = u.host||u.authority||"" unvalidated; ssh spawn :88 argv:[sshBin, dest, cmd] with dest (:78 user@host|host) unguarded for a leading -; :84 remPath= getenv("DOG_REMOTE_PATH") spliced RAW :86 "PATH="+remPath+":$PATH exec keeper "+shq(sp).
• 2026-07-10 revision: still OPEN — wire.js:37 host & :78 dest unvalidated; :88 argv:ssh,dest,cmd no --/leading-dash guard; :85-86 DOG_REMOTE_PATH spliced RAW (no shQuote); vanilla-git :91 dest unguarded too

Outcome

• (pending)