Harden Network Inspector server binding and adb command execution - #2647
Joaquin Jares (joj) merged 6 commits into
Conversation
- Bind RSocket TCP server to 127.0.0.1 instead of all interfaces - Strengthen filepath validation with strict allowlist and path traversal check - Refactor adb command execution to use execFile with argument arrays instead of string concatenation via exec - Update all executeQuery callers to pass argument arrays Co-authored-by: Copilot <[email protected]>
|
/azp run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
|
Hi lucygramley ， Thanks for the contribution and for the Network Inspector hardening work here. Could you please create or link a corresponding issue for this PR? It would help us track the affected Network Inspector surface, the security motivation, and the intended behavior separately from the implementation. The unit test pipeline is currently failing on Linux, Windows, and macOS. Could you please inspect the failing logs and update the PR? One thing I noticed is that most ADB calls were moved to argument-array execution, but one path still reconstructs a command string before calling |
Head branch was pushed to by a user without write access
|
/azp run |
|
Commenter does not have sufficient privileges for PR 2647 in repo microsoft/vscode-react-native |
|
/azp run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
|
Thanks for the contribution. I noticed the pipeline is currently failing because of code formatting issues. Could you please run the project formatting command locally, commit the formatting changes, and push the update to this PR? One small suggestion for future PRs: when possible, please link the PR to a related issue, or create one if there is no existing issue. This helps us track the motivation, review scope, validation status, and reporting more clearly. For small or urgent fixes this may not always be necessary, but it would be helpful for changes like this. |
|
/azp run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
Bind RSocket TCP server to loopback address, strengthen filepath validation, and refactor adb command execution to use execFile with argument arrays.