🛡️ Sentinel: [CRITICAL] Fix command injection via sed in web console config

[mendsec]

🚨 Severity: CRITICAL
💡 Vulnerability: The fix_web_console_config.py script was directly interpolating a user-controlled configuration variable (config.ksc_fqdn) into a sed command string passed to run_remote_sudo. This allowed for command injection if the variable contained single quotes (') to break out of the shell string or premature termination of the expression if it contained unescaped forward slashes (/).
🎯 Impact: If KSC_FQDN or related configuration fields are compromised or set maliciously, an attacker could execute arbitrary code on the target KSC server with sudo privileges.
🔧 Fix: Imported shlex, explicitly escaped forward slashes using .replace('/', r'\/'), and properly wrapped the entire substitute expression for each sed -e argument in shlex.quote() before assembling the final command string.
✅ Verification: Verified by code review, reading the patch files, and executing the automated test suite pytest tests/. Also ensured the linter and format commands pass locally for the modified file.

---

PR created automatically by Jules for task 15043993227396079764 started by @mendsec

Summary by CodeRabbit

• Bug Fixes
  • Improved security when updating web console configuration values.
  • Added protection against command injection and special-character handling issues in server names.
  • Preserved existing correction, permission, restart, logging, and error-handling behavior.

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 81e9a319-0736-4626-90fc-5ed7a1144cb7

📥 Commits

Reviewing files that changed from the base of the PR and between fa83495 and 65e1ceb.

📒 Files selected for processing (2)

• .jules/sentinel.md
• automation/ops/fix_web_console_config.py

Included review availability: Your plan includes up to 1 review per rolling hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The remote sed command now escapes slashes in config.ksc_fqdn and shell-quotes each substitution expression. The security finding documents the injection and syntax risks.

Changes

Web console command security

Layer / File(s)	Summary
Sanitize and quote sed expressions .jules/sentinel.md, automation/ops/fix_web_console_config.py	The script uses shlex.quote() for sed expressions and escapes slashes in config.ksc_fqdn. The security finding documents the associated risks and safeguards.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 65e1c

The change hardens shell argument handling in the web console configuration script. No actionable merge-blocking risk remains after normal checks and review.

Possibly related PRs

• portosoft/ksc-deployment-runbook#141: Modifies the same script to sanitize config.ksc_fqdn and quote sed expressions.
• portosoft/ksc-deployment-runbook#151: Applies the same command-injection fix and documents the security finding.
• portosoft/ksc-deployment-runbook#164: Matches the same sed command construction and security finding changes.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description explains the vulnerability, impact, fix, and verification, but it omits the required change type and checklist sections.	Add the required Tipo de Mudança and Checklist sections, and state which testing, changelog, contribution, and Rocky Linux validation items were completed.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely identifies the critical command-injection fix in the web console configuration script.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch sentinel/fix-sed-command-injection-15043993227396079764

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Failed to generate code suggestions for PR