mirror of
https://github.com/ruvnet/ruflo.git
synced 2026-09-14 14:01:28 +08:00
rUv
0e1d26c11e
* fix(security): patch CVEs, shell injection, SSRF in ruflo
CWE-78 Shell Injection (9 execSync → execFileSync conversions):
- .claude/helpers/github-safe.js: replace execSync(`gh ${args.join(' ')}`)
with execFileSync('gh', args) in no-body and non-body code paths; the
body-with-file path already used a tempfile but still joined args into
a shell string for the final gh invocation.
- v3/@claude-flow/cli/.claude/helpers/github-safe.js: same fix (init-
template copy mirrors the dogfood helper).
- v3/@claude-flow/mcp/.claude/helpers/github-safe.js: older variant
without body-cap; apply execFileSync throughout.
- scripts/audit-supply-chain.mjs: execSync(`npm view "${name}"`) →
execFileSync('npm', ['view', name, ...]) so a malicious package name
in the allowlist JSON cannot inject shell commands.
- scripts/track-clones.mjs: execSync(`gh api repos/${repo}/...`) →
execFileSync('gh', ['api', `repos/${repo}/...`]).
- plugins/ruflo-core/scripts/witness/perf.mjs: six execSync calls in
benchmark runners (git rev-parse, pnpm pack ×2, npm init, npm pkg
set, npm install <tarball>, node verify.mjs) converted to
execFileSync with split argv arrays.
- v3/@claude-flow/browser/tests/e2e/browser-e2e.test.ts: execSync with
template-literal command string replaced by execFileSync with a
split-on-whitespace argv array.
CWE-918 SSRF (2 callCloudFunction guards):
- ruflo/src/mcp-bridge/index.js: add assertSafeUrl() before every
callCloudFunction call — rejects non-HTTPS schemes and private/
loopback IP ranges (10.x, 172.16-31.x, 192.168.x, 127.x, ::1,
fc/fd ULA, localhost, *.local).
- ruflo/src/ruvocal/mcp-bridge/index.js: identical guard applied to
the ruvocal variant of callCloudFunction.
npm audit: 0 vulnerabilities (package.json overrides already cover all
known CVEs; confirmed clean on this audit run).
All 10 github-safe injection smoke tests pass. No new test file failures
introduced vs pre-patch baseline (verified via vitest diff).
Co-Authored-By: claude-flow <ruv@ruv.net>
* fix(supply-chain): use execFileSync instead of undefined execSync in runCveAudit
The import on line 35 only brought in `execFileSync` from `node:child_process`,
but `runCveAudit` called the never-imported `execSync`, causing a ReferenceError
on every audit run and reporting 2 spurious CVE findings (one per audited package).
Replace `execSync('npm audit ...')` with `execFileSync('npm', [...args])` to
match the already-correct pattern used in `runPublisherTrustAudit` (line 303).
This also provides the CWE-78 shell-injection mitigation already documented in
that function's comment.
Full audit now exits 0: 0 CVE, 0 lockfile, 0 allowlist, 0 typosquat findings.
Co-Authored-By: claude-flow <ruv@ruv.net>