sanbuphy dee964ca39 Fix command injection (CWE-78) in audit-harness.sh ...

any_file_match() used `ls $REPO/$pattern` without quoting $REPO. Because
the variable was unquoted during word splitting, a crafted REPO value
such as "/tmp; rm -rf /" would be split on the semicolon into a second,
independent command — a classic shell injection (CWE-78).

Replace the `ls | grep` pipeline with `compgen -G "$REPO/$pattern"`.
The entire `$REPO/$pattern` is now double-quoted, so no splitting or
pathname expansion happens on $REPO, and compgen performs the glob match
without spawning an external process.

All other 17 `$REPO` uses in the file were already correctly quoted
(inside `[[ ]]`, `"$REPO/..."`, or `find "$REPO"`), so this was the
single exploitable point.

2026-06-30 09:17:46 +08:00

..

audit-harness.sh

Fix command injection (CWE-78) in audit-harness.sh

2026-06-30 09:17:46 +08:00