From f2a18beca444235eeab324134c782950864a4865 Mon Sep 17 00:00:00 2001 From: Ruben Fiszel Date: Fri, 10 Jul 2026 12:48:02 +0000 Subject: [PATCH] fix(security): remove git from Deno sandbox allow-run (GHSA-gj6h-vw66-mr8f) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The `// sandbox` annotation restricts Deno to `--allow-run=git,/usr/bin/chromium`. git can be coerced into spawning `/bin/sh` via hook configs such as `git -c core.fsmonitor= status`, and that subprocess is spawned by git — not Deno — so it is invisible to Deno's permission model. This let any user with script-execution permission run arbitrary OS commands as root inside the worker, fully defeating the sandbox. The advisory's alternative (injecting `-c core.fsmonitor=false -c core.hooksPath=/dev/null`) does not apply here: the user's own script invokes git directly via `Deno.Command`, so Windmill cannot inject hardening flags into that call. Removing git from the allowlist is the only complete fix. git was originally allowed for git-sync-adjacent use, which no longer needs it. Verified with the advisory PoC: git invocation now returns `Requires run access to "git"` and the sandbox escape is closed. chromium (puppeteer) support is preserved. Fixes WIN-2151 Co-Authored-By: Claude Opus 4.8 (1M context) --- backend/windmill-worker/src/deno_executor.rs | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/backend/windmill-worker/src/deno_executor.rs b/backend/windmill-worker/src/deno_executor.rs index a446548e1f..738fb59370 100644 --- a/backend/windmill-worker/src/deno_executor.rs +++ b/backend/windmill-worker/src/deno_executor.rs @@ -481,7 +481,11 @@ try {{ args.push("--allow-write=./"); args.push("--allow-env"); args.push("--allow-import"); - args.push("--allow-run=git,/usr/bin/chromium"); + // git is intentionally NOT in this allowlist: git can be coerced into + // spawning /bin/sh via hook configs (e.g. `-c core.fsmonitor=`), + // which escapes Deno's permission model and defeats the sandbox + // (GHSA-gj6h-vw66-mr8f). Only allow the specific chromium binary. + args.push("--allow-run=/usr/bin/chromium"); } else { args.push("-A"); }