[I] [Task]: Invoke GnuPG with an argument list instead of a shell command string (hop)

["bamaer (via GitHub)" <gi...@apache.org>]

bamaer opened a new issue, #8311:
URL: https://github.com/apache/hop/issues/8311

   ### What needs to happen?
   
   `GPG.execGnuPG()` builds a command string and runs it through a shell
   (`/bin/sh -c` on POSIX, `Runtime.exec(String)` on Windows) — `GPG.java:160-176`.
   Callers concatenate filenames, key IDs and the passphrase into that string
   wrapped in double quotes, which do not prevent shell expansion. Filenames come
   from a directory scan (`ActionPGPEncryptFiles.java:621`), so their content is
   interpreted rather than passed to GnuPG literally.
   
   Change `execGnuPG` to take a `List<String>` and use
   `new ProcessBuilder(command).start()` with no shell. The ten call sites in the
   same file drop their quote concatenation; `gnuPGCommand` (`"--batch --armor "`)
   becomes two list elements.
   
   Same code path, worth fixing together: `decryptFile()` passes the passphrase on
   argv via `--passphrase` (readable in the process table) and the debug log at
   line 165 logs it. Both go away by using `--passphrase-fd 0`, already used
   elsewhere in the class.
   
   No public API or metadata change — `execGnuPG` is private and the public
   signatures stay as they are.
   
   ### Issue Priority
   
   Priority: 2
   
   ### Issue Component
   
   Component: Actions


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@hop.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [Task]: Invoke GnuPG with an argument list instead of a shell command string (hop)

["bamaer (via GitHub)" <gi...@apache.org>]

bamaer commented on issue #8311:
URL: https://github.com/apache/hop/issues/8311#issuecomment-5616524220

   .take-issue


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@hop.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [Task]: Invoke GnuPG with an argument list instead of a shell command string (hop)

["mattcasters (via GitHub)" <gi...@apache.org>]

mattcasters closed issue #8311: [Task]: Invoke GnuPG with an argument list instead of a shell command string
URL: https://github.com/apache/hop/issues/8311


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@hop.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org