Fixed shell command built from environment values

[odaysec]

browserstack-local-nodejs/lib/Local.js

Line 40 in 440aa80

childProcess.exec('echo "" > ' + that.logfile);

browserstack-local-nodejs/lib/Local.js

Lines 89 to 91 in 440aa80

	childProcess.exec('echo "" > ' + that.logfile);
	that.opcode = 'start';

Dynamically constructing a shell command with values from the local environment, such as file paths, may inadvertently change the meaning of the shell command. Such changes can occur when an environment value contains characters that the shell interprets in a special way, for instance quotes and spaces. This can result in the shell command misbehaving, or even allowing a malicious user to execute arbitrary commands on the system.

fix this problem, we should avoid constructing shell commands by concatenating potentially unsafe values and passing them to childProcess.exec. Instead, we should use Node's built-in file system APIs to perform the intended operation. In this case, the command 'echo "" > logfile' is intended to truncate or create an empty log file. The equivalent and safer approach is to use fs.writeFileSync(logfile, '') (for synchronous code) or fs.writeFile(logfile, '', callback) (for asynchronous code). This avoids invoking a shell entirely and is cross-platform.

Specifically, in lib/Local.js, replace both instances of childProcess.exec('echo "" > ' + that.logfile); (in both startSync and start) with the appropriate fs.writeFileSync or fs.writeFile calls. No new imports are needed, as fs is already imported.