packages/opencode/src/cli/cmd/github.ts (1)

337-352: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Command injection risk from env-controlled install URL.

On Line 337/345-352, GITHUB_APP_INSTALL_URL comes from ALTIMATE_CODE_GITHUB_APP_INSTALL_URL and is interpolated into a shell command passed to exec(...). A crafted value with quotes/metacharacters can break out of the quoted URL and execute arbitrary commands.

Use non-shell process APIs (execFile/spawn with argument arrays) and validate with new URL(...) + allowlisted host/path before launching.

Suggested hardening

-import { exec } from "child_process"
+import { execFile } from "child_process"

...
-            const command =
-              process.platform === "darwin"
-                ? `open "${url}"`
-                : process.platform === "win32"
-                  ? `start "" "${url}"`
-                  : `xdg-open "${url}"`
-
-            exec(command, (error) => {
+            let parsed: URL
+            try {
+              parsed = new URL(url)
+            } catch {
+              s.stop("GitHub app installation URL is invalid.")
+              throw new UI.CancelledError()
+            }
+            if (parsed.protocol !== "https:" || parsed.hostname !== "github.com" || !parsed.pathname.startsWith("/apps/")) {
+              s.stop("GitHub app installation URL must be a https://github.com/apps/... URL.")
+              throw new UI.CancelledError()
+            }
+
+            const [bin, args] =
+              process.platform === "darwin"
+                ? ["open", [parsed.toString()]]
+                : process.platform === "win32"
+                  ? ["rundll32", ["url.dll,FileProtocolHandler", parsed.toString()]]
+                  : ["xdg-open", [parsed.toString()]]
+
+            execFile(bin, args, (error) => {
               if (error) {
                 prompts.log.warn(`Could not open browser. Please visit: ${url}`)
               }
             })

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/opencode/src/cli/cmd/github.ts` around lines 337 - 352, The code
builds a shell command using GITHUB_APP_INSTALL_URL and passes it to exec (see
the exec call and command variable assembled based on process.platform), which
allows command injection; fix by parsing and validating GITHUB_APP_INSTALL_URL
with new URL(...) and enforcing an allowlist on hostname/path, then launch the
browser without a shell by using execFile or spawn with an argument array
(platform-specific handling for "open"/"start"/"xdg-open" commands) instead of
interpolating the URL into a shell string; update the code around the command
variable, the exec(...) invocation, and any error handling to use the new
validated URL and non-shell process API.