node-opcua / node-opcua-pki / 32146778994

91%

Build Type

push

github

Committed by erossignon

Commit Message

fix(security): invoke openssl without a shell

execute_openssl now takes an argv array and spawns the openssl binary
directly (no shell), so file paths, subjects, and other values can never
be reinterpreted as shell metacharacters, redirections, or extra
commands. Every caller (CertificateAuthority, CertificateManager helpers,
PFX toolbox, openssl discovery) is converted; the one call that relied
on `>` now writes the captured stdout itself. Passphrases still travel
via -passin/-passout env:. Regression test drives a subject and a PKI
location full of metacharacters through self-sign, CA sign, revoke, CRL.

Coverage Stats

538 of 714 branches covered (75.35%)

45 of 47 new or added lines in 4 files covered. (95.74%)

1 existing line in 1 file now uncovered.

1553 of 1706 relevant lines covered (91.03%)

289.49 hits per line