@evomap/evolver 1.89.20 → 1.91.0

package/src/gep/selfPR.js

@@ -9,11 +9,39 @@
 const fs = require('fs');
 const path = require('path');
 const crypto = require('crypto');
-const { execSync } = require('child_process');
+const { execFileSync } = require('child_process');
 // 10 MB — prevents RangeError on large child process output (e.g. git log/diff
 // on large repos). See GHSA reports / issue #451.
 const MAX_EXEC_BUFFER = 10 * 1024 * 1024;
 
+// SECURITY (Semgrep #285 detect-child-process): every git/gh invocation here
+// goes through argv-form execFileSync (no shell), NEVER string concatenation.
+// PR titles/branches/file paths can carry mutation rationale that is
+// model-generated or hub-fetched (untrusted), and a `git commit -m "..."`
+// shell string would let `$(...)` / backticks in that text execute. Passing
+// each value as a discrete argv element removes the shell entirely, so no
+// metacharacter can break out. Injectable for tests via __test.setExecFile.
+let _execFileImpl = execFileSync;
+
+// Run `git <args...>` with no shell. Returns { ok, out } / { ok:false, err }
+// mirroring runGh so callers stay uniform.
+function runGit(args, opts) {
+  const o = opts || {};
+  try {
+    const out = _execFileImpl('git', args, {
+      cwd: o.cwd,
+      timeout: o.timeoutMs || 10000,
+      encoding: 'utf8',
+      stdio: ['pipe', 'pipe', 'pipe'],
+      maxBuffer: MAX_EXEC_BUFFER,
+      env: o.env || process.env,
+    });
+    return { ok: true, out: String(out || '').trim() };
+  } catch (e) {
+    return { ok: false, out: '', err: String(e && e.stderr ? e.stderr : e.message || e).slice(0, 500) };
+  }
+}
+
 const { getEvolutionDir, getRepoRoot, getEvolverInstallRoot } = require('./paths');
 const { fullLeakCheck, redactString } = require('./sanitize');
 const {
@@ -251,11 +279,14 @@ function buildPRTitle(mutation) {
   return '[Auto-Mutation] ' + rationale;
 }
 
+// Run `gh <args...>` with no shell. `args` is an ARGV ARRAY, not a string, so
+// repo names / branch / title / file paths are discrete arguments the shell
+// never sees.
 function runGh(args, opts) {
   const timeoutMs = (opts && opts.timeoutMs) || SELF_PR_TIMEOUT_MS;
   const cwd = (opts && opts.cwd) || getRepoRoot();
   try {
-    const result = execSync('gh ' + args, {
+    const result = _execFileImpl('gh', args, {
       cwd: cwd,
       timeout: timeoutMs,
       encoding: 'utf8',
@@ -272,21 +303,13 @@ function getGitDiff(changedFiles, repoRoot) {
   const parts = [];
   for (const f of changedFiles) {
     const before = parts.length;
-    try {
-      const result = execSync(
-        'git diff HEAD -- "' + f + '"',
-        { cwd: repoRoot, timeout: 10000, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'], maxBuffer: MAX_EXEC_BUFFER }
-      );
-      if (result && result.trim()) parts.push(result.trim());
-    } catch (_) {}
+    // `f` is a discrete argv element after `--`, so a path with quotes or
+    // shell metacharacters cannot break out of the command.
+    const head = runGit(['diff', 'HEAD', '--', f], { cwd: repoRoot });
+    if (head.ok && head.out) parts.push(head.out);
     if (parts.length === before) {
-      try {
-        const result = execSync(
-          'git diff -- "' + f + '"',
-          { cwd: repoRoot, timeout: 10000, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'], maxBuffer: MAX_EXEC_BUFFER }
-        );
-        if (result && result.trim()) parts.push(result.trim());
-      } catch (_) {}
+      const noHead = runGit(['diff', '--', f], { cwd: repoRoot });
+      if (noHead.ok && noHead.out) parts.push(noHead.out);
     }
   }
   return parts.join('\n');
@@ -359,7 +382,7 @@ async function maybeCreatePR({ capsule, event, mutation, gene, blastRadius }) {
   try {
     console.log('[SelfPR] Creating PR on ' + repo + ' branch ' + branch + '...');
 
-    const forkCheck = runGh('repo view ' + repo + ' --json name', { timeoutMs: 15000 });
+    const forkCheck = runGh(['repo', 'view', repo, '--json', 'name'], { timeoutMs: 15000 });
     if (!forkCheck.ok) {
       console.warn('[SelfPR] Cannot access repo ' + repo + ': ' + (forkCheck.err || 'unknown'));
       return { attempted: false, reason: 'repo_access_failed' };
@@ -372,7 +395,7 @@ async function maybeCreatePR({ capsule, event, mutation, gene, blastRadius }) {
     fs.mkdirSync(tmpDir, { recursive: true });
 
     const cloneResult = runGh(
-      'repo clone ' + repo + ' "' + tmpDir + '" -- --depth 1',
+      ['repo', 'clone', repo, tmpDir, '--', '--depth', '1'],
       { timeoutMs: 60000 }
     );
     if (!cloneResult.ok) {
@@ -380,10 +403,9 @@ async function maybeCreatePR({ capsule, event, mutation, gene, blastRadius }) {
       return { attempted: false, reason: 'clone_failed' };
     }
 
-    try {
-      execSync('git checkout -b "' + branch + '"', { cwd: tmpDir, timeout: 10000, maxBuffer: MAX_EXEC_BUFFER });
-    } catch (e) {
-      console.warn('[SelfPR] Branch creation failed: ' + (e.message || e));
+    const checkoutResult = runGit(['checkout', '-b', branch], { cwd: tmpDir });
+    if (!checkoutResult.ok) {
+      console.warn('[SelfPR] Branch creation failed: ' + (checkoutResult.err || 'unknown'));
       return { attempted: false, reason: 'branch_failed' };
     }
 
@@ -397,26 +419,38 @@ async function maybeCreatePR({ capsule, event, mutation, gene, blastRadius }) {
       }
     }
 
-    try {
-      execSync('git add -A', { cwd: tmpDir, timeout: 10000, maxBuffer: MAX_EXEC_BUFFER });
-      const statusOut = execSync('git status --porcelain', { cwd: tmpDir, timeout: 10000, encoding: 'utf8', maxBuffer: MAX_EXEC_BUFFER });
-      if (!statusOut || !statusOut.trim()) {
-        console.log('[SelfPR] No changes to commit in public repo clone.');
-        return { attempted: false, reason: 'no_public_diff' };
-      }
-      execSync(
-        'git commit -m "' + title.replace(/"/g, '\\"') + '"',
-        { cwd: tmpDir, timeout: 10000, env: Object.assign({}, process.env, { GIT_AUTHOR_NAME: 'evolver-bot', GIT_AUTHOR_EMAIL: 'evolver-bot@evomap.ai', GIT_COMMITTER_NAME: 'evolver-bot', GIT_COMMITTER_EMAIL: 'evolver-bot@evomap.ai' }) }
-      );
-    } catch (e) {
-      console.warn('[SelfPR] Commit failed: ' + (e.message || e));
+    const addResult = runGit(['add', '-A'], { cwd: tmpDir });
+    if (!addResult.ok) {
+      console.warn('[SelfPR] Commit failed: ' + (addResult.err || 'git add failed'));
+      return { attempted: false, reason: 'commit_failed' };
+    }
+    const statusResult = runGit(['status', '--porcelain'], { cwd: tmpDir });
+    if (!statusResult.ok) {
+      console.warn('[SelfPR] Commit failed: ' + (statusResult.err || 'git status failed'));
+      return { attempted: false, reason: 'commit_failed' };
+    }
+    if (!statusResult.out) {
+      console.log('[SelfPR] No changes to commit in public repo clone.');
+      return { attempted: false, reason: 'no_public_diff' };
+    }
+    // title is passed as a discrete argv element, so its content (mutation
+    // rationale, possibly model-generated) is never shell-interpreted; no
+    // manual quote-escaping needed and `$(...)`/backticks stay literal.
+    const commitResult = runGit(['commit', '-m', title], {
+      cwd: tmpDir,
+      env: Object.assign({}, process.env, {
+        GIT_AUTHOR_NAME: 'evolver-bot', GIT_AUTHOR_EMAIL: 'evolver-bot@evomap.ai',
+        GIT_COMMITTER_NAME: 'evolver-bot', GIT_COMMITTER_EMAIL: 'evolver-bot@evomap.ai',
+      }),
+    });
+    if (!commitResult.ok) {
+      console.warn('[SelfPR] Commit failed: ' + (commitResult.err || 'git commit failed'));
       return { attempted: false, reason: 'commit_failed' };
     }
 
-    try {
-      execSync('git push origin "' + branch + '"', { cwd: tmpDir, timeout: 30000 });
-    } catch (e) {
-      console.warn('[SelfPR] Push failed: ' + (e.message || e));
+    const pushResult = runGit(['push', 'origin', branch], { cwd: tmpDir, timeoutMs: 30000 });
+    if (!pushResult.ok) {
+      console.warn('[SelfPR] Push failed: ' + (pushResult.err || 'git push failed'));
       return { attempted: false, reason: 'push_failed' };
     }
 
@@ -424,11 +458,8 @@ async function maybeCreatePR({ capsule, event, mutation, gene, blastRadius }) {
     fs.writeFileSync(bodyFile, body);
 
     const prResult = runGh(
-      'pr create --repo ' + repo +
-      ' --head "' + branch + '"' +
-      ' --title "' + title.replace(/"/g, '\\"') + '"' +
-      ' --body-file "' + bodyFile + '"' +
-      ' --label "auto-mutation"',
+      ['pr', 'create', '--repo', repo, '--head', branch,
+        '--title', title, '--body-file', bodyFile, '--label', 'auto-mutation'],
       { cwd: tmpDir, timeoutMs: 30000 }
     );
 
@@ -466,4 +497,12 @@ module.exports = {
   _loadObfuscatedFromManifest: loadObfuscatedFromManifest,
   _resetObfuscatedCache,
   _setManifestRetryTtlForTests,
+  // Argv-form exec surface (Semgrep #285): lets tests capture the exact
+  // (file, args) handed to execFileSync and assert no shell string is ever
+  // built, so a metacharacter-laden title/branch/path cannot inject.
+  __test: {
+    setExecFile(fn) { _execFileImpl = fn || execFileSync; },
+    runGit,
+    runGh,
+  },
 };