fix: critical issue go/command-injection (#56)

* fix: critical issue go/command-injection

* fix: retrieve home dir with os.UserHomeDir()

Author: parfenovvs

pkg/console/console.go

@@ -2,7 +2,9 @@ package console
 
 import (
 	"fmt"
+	"os"
 	"os/exec"
+	"path/filepath"
 	"strings"
 
 	log "github.com/sirupsen/logrus"
@@ -14,7 +16,7 @@ func RunCmd(sudo bool, command string, args ...string) (string, error) {
 
 	var stdout strings.Builder
 	var stderr strings.Builder
-	
+
 	if sudo {
 		// Check if sudo is available
 		_, err := exec.LookPath("sudo")
@@ -26,7 +28,7 @@ func RunCmd(sudo bool, command string, args ...string) (string, error) {
 		}
 	} else {
 		cmd = exec.Command(command, args...)
-	}	
+	}
 
 	cmd.Stdout = &stdout
 	cmd.Stderr = &stderr
@@ -37,4 +39,107 @@ func RunCmd(sudo bool, command string, args ...string) (string, error) {
 	}
 
 	return stdout.String(), nil
-}
+}
+
+func WgShow() (string, error) {
+	var stdout strings.Builder
+	var stderr strings.Builder
+
+	cmd := exec.Command("sudo", "wg", "show")
+
+	cmd.Stdout = &stdout
+	cmd.Stderr = &stderr
+
+	err := cmd.Run()
+	if err != nil {
+		return stdout.String(), fmt.Errorf("wg show command execution failed: %w, stderr: %v, stdout: %v", err, stderr.String(), stdout.String())
+	}
+
+	return stdout.String(), nil
+}
+
+func WgUp(cfgPath string) error {
+	cleanedPath, err := sanitizeWgConfigPath(cfgPath)
+	if err != nil {
+		return fmt.Errorf("invalid WireGuard config path: %w", err)
+	}
+
+	var stdout strings.Builder
+	var stderr strings.Builder
+
+	cmd := exec.Command("sudo", "wg-quick", "up", cleanedPath)
+
+	cmd.Stdout = &stdout
+	cmd.Stderr = &stderr
+
+	err = cmd.Run()
+	if err != nil {
+		return fmt.Errorf("wg-quick up command execution failed: %w, stderr: %v, stdout: %v", err, stderr.String(), stdout.String())
+	}
+
+	return nil
+}
+
+func WgDown(cfgPath string) error {
+	cleanedPath, err := sanitizeWgConfigPath(cfgPath)
+	if err != nil {
+		return fmt.Errorf("invalid WireGuard config path: %w", err)
+	}
+
+	var stdout strings.Builder
+	var stderr strings.Builder
+
+	cmd := exec.Command("sudo", "wg-quick", "down", cleanedPath)
+
+	cmd.Stdout = &stdout
+	cmd.Stderr = &stderr
+
+	err = cmd.Run()
+	if err != nil {
+		return fmt.Errorf("wg-quick down command execution failed: %w, stderr: %v, stdout: %v", err, stderr.String(), stdout.String())
+	}
+
+	return nil
+}
+
+func sanitizeWgConfigPath(cfgPath string) (string, error) {
+	// Clean the path (removes .., redundant separators, etc.)
+	cleanPath := filepath.Clean(cfgPath)
+
+	// Expand home directory if present
+	home, err := os.UserHomeDir()
+	if err != nil {
+		return "", fmt.Errorf("failed to get home directory: %w", err)
+	} else if strings.HasPrefix(cleanPath, "~/") {
+		cleanPath = filepath.Join(home, cleanPath[2:])
+	}
+
+	// Convert to absolute path
+	absPath, err := filepath.Abs(cleanPath)
+	if err != nil {
+		return "", fmt.Errorf("failed to resolve absolute path: %w", err)
+	}
+
+	// Verify the file exists and is a regular file
+	fileInfo, err := os.Stat(absPath)
+	if err != nil {
+		return "", fmt.Errorf("config file not accessible: %w", err)
+	}
+
+	if !fileInfo.Mode().IsRegular() {
+		return "", fmt.Errorf("config path is not a regular file")
+	}
+
+	// Ensure it's within the expected config directory
+	expectedBase := filepath.Join(home, ".config", "mbvpn", "servers")
+	if !strings.HasPrefix(absPath, expectedBase) {
+		return "", fmt.Errorf("config file must be within %s", expectedBase)
+	}
+
+	// Verify file extension (WireGuard configs must be .conf)
+	if filepath.Ext(absPath) != ".conf" {
+		return "", fmt.Errorf("config file must have .conf extension")
+	}
+
+	return absPath, nil
+}

pkg/remote/holocron.go

@@ -15,7 +15,6 @@ import (
 )
 
 const (
-	// baseUrl = "https://idms-holocron-stage.mwbsys.com/graphql"
 	productCode    = "MBMA-C"
 	productVersion = "5.14.0"
 )

pkg/vpn/vpn.go

@@ -268,7 +268,7 @@ func (vpn *DefaultVpn) Connect(cfg string) error {
 	}
 
 	output.PrintMsg(fmt.Sprintf("Calling 'wg-quick up %s'", cfgPath), output.MsgOutput)
-	_, err = console.RunCmd(true, "wg-quick", "up", cfgPath)
+	err = console.WgUp(cfgPath)
 	if err != nil {
 		return errors.NewVPNError("connect", err)
 	}
@@ -301,7 +301,7 @@ func (vpn *DefaultVpn) Disconnect(cfg string) error {
 		return errors.NewConfigError("ensure config directory", err)
 	}
 
-	_, err = console.RunCmd(true, "wg-quick", "down", filepath.Join(cfgDir, cfg+".conf"))
+	err = console.WgDown(filepath.Join(cfgDir, cfg+".conf"))
 	if err != nil {
 		return errors.NewVPNError("disconnect", err)
 	}
@@ -380,7 +380,7 @@ AllowedIPs = 0.0.0.0/0, ::/0`,
 }
 
 func getConnectedServers() ([]string, error) {
-	output, err := console.RunCmd(true, "wg", "show")
+	output, err := console.WgShow()
 	if err != nil {
 		return nil, fmt.Errorf("failed to execute 'wg show': %w", err)
 	}