fix(javascript-lang-security-detect-child-process-detect-child-process): Shell Injection via Unquoted xcframeworkPath in codesign Command

[zepto-gaurav]

Optimus AutoFix — Automated Security Fix

Findings Fixed

Finding	Detector	Severity	File
Shell Injection via Unquoted xcframeworkPath in codesign Command	javascript.lang.security.detect-child-process.detect-child-process	high	/tmp/scan_repo/scripts/releases/ios-prebuild/compose-framework.js

Fix Strategy

Shell Injection via Unquoted xcframeworkPath in codesign Command

Changes Made

• scripts/releases/ios-prebuild/compose-framework.js: Read the FULL file before making changes to understand all require('child_process') imports and every execSync call site. Then apply the following changes:

1. Update the child_process import (wherever it appears near the top of the file): add execFileSync alongside any existing execSync import. If execSync is no longer used after the fixes below, remove it from the import.

2. Fix signXCFramework (lines 164–171): Replace the shell-string construction + execSync call entirely with execFileSync, which bypasses the shell interpreter:

   // BEFORE
   const command = `codesign --timestamp --sign "${identity}" ${xcframeworkPath}`;
   execSync(command, {stdio: 'inherit'});
   // AFTER
   execFileSync('codesign', ['--timestamp', '--sign', identity, xcframeworkPath], {stdio: 'inherit'});

   This eliminates shell interpretation for BOTH identity and xcframeworkPath — double-quoting identity was insufficient because $(...) or embedded " could still break out. Passing all arguments as discrete array elements removes the shell from the execution path entirely.

3. Fix copyBundles (line 155): The same vulnerable pattern is present — execSync with a template-literal shell command. Even though these paths derive from path.join(), they still pass through /bin/sh. Replace with:

   // BEFORE
   execSync(`cp -r "${sourceBundlePath}/" "${targetBundlePath}"`);
   // AFTER
   execFileSync('cp', ['-r', `${sourceBundlePath}/`, targetBundlePath]);

   No shell, no quoting needed, no injection surface.

Do NOT change any other logic, call signatures, or surrounding code. The behavioral output of both functions is identical — only the execution mechanism changes (execFileSync bypasses /bin/sh).

AI Review

• Verdict: Approved
• Confidence: high
• Summary: The fix correctly and completely addresses the shell injection vulnerability pattern. Both signXCFramework and copyBundles are migrated from template-literal shell strings passed to execSync to discrete argument arrays passed to execFileSync, which bypasses /bin/sh entirely. The root cause (shell interpretation) is eliminated rather than band-aided with additional quoting. Argument ordering, the stdio: 'inherit' option, and the trailing / for the cp -r call are all preserved correctly. One minor cleanliness issue is noted below.

Issues

• [suggestion] The execSync import is retained but appears to have no remaining uses in the file after both call sites were migrated to execFileSync. If there are no other execSync calls elsewhere in this file, the import should be cleaned up (const {execFileSync} = require('child_process')). This is a dead-import / code hygiene issue, not a security concern, but the fix plan explicitly called out removing it if unused.

Risk Assessment

• Risk Level: low
• Breaking Change: No
• Test Impact: Any integration tests that mock child_process.execSync and exercise signXCFramework or copyBundles will need to be updated to mock execFileSync instead. Unit tests that only check return values or console output are unaffected.

---

Auto-generated by Optimus AutoFix Agent. Review carefully before merging.