From fcd58191d437b3558811985aa32f233eb5493759 Mon Sep 17 00:00:00 2001
From: "claude[bot]" <209825114+claude[bot]@users.noreply.github.com>
Date: Wed, 10 Sep 2025 16:14:25 +0000
Subject: [PATCH] fix: force stdin to Stdio::null for all user code execution
 (#6575)

Set stdin to Stdio::null for all Commands that execute user code across all supported languages to prevent unwanted input consumption. This affects Python, Deno, Bash, PowerShell, Go, Rust, PHP, Ruby, Java, C#, Ansible, Nu, and Bun executors.

The dedicated worker handler was intentionally left unchanged as it requires stdin for inter-process communication.

Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
---
 backend/windmill-worker/src/ansible_executor.rs | 1 +
 backend/windmill-worker/src/bash_executor.rs    | 2 ++
 backend/windmill-worker/src/bun_executor.rs     | 2 ++
 backend/windmill-worker/src/csharp_executor.rs  | 1 +
 backend/windmill-worker/src/deno_executor.rs    | 1 +
 backend/windmill-worker/src/go_executor.rs      | 2 +-
 backend/windmill-worker/src/java_executor.rs    | 1 +
 backend/windmill-worker/src/nu_executor.rs      | 1 +
 backend/windmill-worker/src/php_executor.rs     | 1 +
 backend/windmill-worker/src/python_executor.rs  | 1 +
 backend/windmill-worker/src/ruby_executor.rs    | 1 +
 backend/windmill-worker/src/rust_executor.rs    | 1 +
 12 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/backend/windmill-worker/src/ansible_executor.rs b/backend/windmill-worker/src/ansible_executor.rs
index 5038495af1..72640eb9da 100644
--- a/backend/windmill-worker/src/ansible_executor.rs
+++ b/backend/windmill-worker/src/ansible_executor.rs
@@ -1109,6 +1109,7 @@ fi
             .env("BASE_INTERNAL_URL", base_internal_url)
             .env("HOME", HOME_ENV.as_str())
             .args(cmd_args)
+            .stdin(Stdio::null())
             .stdout(Stdio::piped())
             .stderr(Stdio::piped());
 
diff --git a/backend/windmill-worker/src/bash_executor.rs b/backend/windmill-worker/src/bash_executor.rs
index 7fda8ee783..b224957958 100644
--- a/backend/windmill-worker/src/bash_executor.rs
+++ b/backend/windmill-worker/src/bash_executor.rs
@@ -212,6 +212,7 @@ exit $exit_status
             .env("BASE_INTERNAL_URL", base_internal_url)
             .env("HOME", HOME_ENV.as_str())
             .args(cmd_args)
+            .stdin(Stdio::null())
             .stdout(Stdio::piped())
             .stderr(Stdio::piped());
         start_child_process(bash_cmd, BIN_BASH.as_str(), false).await?
@@ -807,6 +808,7 @@ $env:PSModulePath = \"{};$PSModulePathBackup\"",
             .env("BASE_INTERNAL_URL", base_internal_url)
             .env("HOME", HOME_ENV.as_str())
             .args(&cmd_args)
+            .stdin(Stdio::null())
             .stdout(Stdio::piped())
             .stderr(Stdio::piped());
 
diff --git a/backend/windmill-worker/src/bun_executor.rs b/backend/windmill-worker/src/bun_executor.rs
index d64926b580..dce084bdf4 100644
--- a/backend/windmill-worker/src/bun_executor.rs
+++ b/backend/windmill-worker/src/bun_executor.rs
@@ -1412,6 +1412,7 @@ try {{
                 .envs(reserved_variables)
                 .envs(common_bun_proc_envs)
                 .args(vec!["--preserve-symlinks", &script_path])
+                .stdin(Stdio::null())
                 .stdout(Stdio::piped())
                 .stderr(Stdio::piped());
 
@@ -1442,6 +1443,7 @@ try {{
                 .envs(reserved_variables)
                 .envs(common_bun_proc_envs)
                 .args(args)
+                .stdin(Stdio::null())
                 .stdout(Stdio::piped())
                 .stderr(Stdio::piped());
 
diff --git a/backend/windmill-worker/src/csharp_executor.rs b/backend/windmill-worker/src/csharp_executor.rs
index aff6b575ea..84cc3184a3 100644
--- a/backend/windmill-worker/src/csharp_executor.rs
+++ b/backend/windmill-worker/src/csharp_executor.rs
@@ -599,6 +599,7 @@ pub async fn handle_csharp_job(
             .env("DOTNET_ROOT", DOTNET_ROOT.as_str())
             .env("BASE_INTERNAL_URL", base_internal_url)
             .env("HOME", HOME_ENV.as_str())
+            .stdin(Stdio::null())
             .stdout(Stdio::piped())
             .stderr(Stdio::piped());
         #[cfg(windows)]
diff --git a/backend/windmill-worker/src/deno_executor.rs b/backend/windmill-worker/src/deno_executor.rs
index a61b581262..431a457d74 100644
--- a/backend/windmill-worker/src/deno_executor.rs
+++ b/backend/windmill-worker/src/deno_executor.rs
@@ -412,6 +412,7 @@ try {{
             .envs(reserved_variables)
             .envs(common_deno_proc_envs)
             .args(args)
+            .stdin(Stdio::null())
             .stdout(Stdio::piped())
             .stderr(Stdio::piped());
         start_child_process(deno_cmd, DENO_PATH.as_str(), false).await?
diff --git a/backend/windmill-worker/src/go_executor.rs b/backend/windmill-worker/src/go_executor.rs
index 201da5b959..85adbf7fea 100644
--- a/backend/windmill-worker/src/go_executor.rs
+++ b/backend/windmill-worker/src/go_executor.rs
@@ -405,7 +405,7 @@ func Run(req Req) (interface{{}}, error){{
         #[cfg(windows)]
         set_windows_env_vars(&mut run_go);
 
-        run_go.stdout(Stdio::piped()).stderr(Stdio::piped());
+        run_go.stdin(Stdio::null()).stdout(Stdio::piped()).stderr(Stdio::piped());
         start_child_process(run_go, &compiled_executable_name, false).await?
     };
     let handle_result = handle_child(
diff --git a/backend/windmill-worker/src/java_executor.rs b/backend/windmill-worker/src/java_executor.rs
index 5a779ad990..6aa12d5024 100644
--- a/backend/windmill-worker/src/java_executor.rs
+++ b/backend/windmill-worker/src/java_executor.rs
@@ -689,6 +689,7 @@ async fn run<'a>(
             }
         }
         cmd.args(&["-classpath", &classpath, "net.script.App"])
+            .stdin(Stdio::null())
             .stdout(Stdio::piped())
             .stderr(Stdio::piped());
 
diff --git a/backend/windmill-worker/src/nu_executor.rs b/backend/windmill-worker/src/nu_executor.rs
index 58f5e39b1f..a52270e745 100644
--- a/backend/windmill-worker/src/nu_executor.rs
+++ b/backend/windmill-worker/src/nu_executor.rs
@@ -311,6 +311,7 @@ async fn run<'a>(
                 //         .join(",")
                 // ),
             ])
+            .stdin(Stdio::null())
             .stdout(Stdio::piped())
             .stderr(Stdio::piped());
 
diff --git a/backend/windmill-worker/src/php_executor.rs b/backend/windmill-worker/src/php_executor.rs
index 008400daf8..cdfd4cfe6f 100644
--- a/backend/windmill-worker/src/php_executor.rs
+++ b/backend/windmill-worker/src/php_executor.rs
@@ -321,6 +321,7 @@ try {{
                 .env("COMPOSER_HOME", &*COMPOSER_CACHE_DIR)
                 .env("BASE_INTERNAL_URL", base_internal_url)
                 .args(args)
+                .stdin(Stdio::null())
                 .stdout(Stdio::piped())
                 .stderr(Stdio::piped());
             php_cmd
diff --git a/backend/windmill-worker/src/python_executor.rs b/backend/windmill-worker/src/python_executor.rs
index e8291f771a..c41089652b 100644
--- a/backend/windmill-worker/src/python_executor.rs
+++ b/backend/windmill-worker/src/python_executor.rs
@@ -845,6 +845,7 @@ mount {{
             .env("BASE_INTERNAL_URL", base_internal_url)
             .env("HOME", HOME_ENV.as_str())
             .args(args)
+            .stdin(Stdio::null())
             .stdout(Stdio::piped())
             .stderr(Stdio::piped());
 
diff --git a/backend/windmill-worker/src/ruby_executor.rs b/backend/windmill-worker/src/ruby_executor.rs
index 944ee5ee9c..fb087a9d24 100644
--- a/backend/windmill-worker/src/ruby_executor.rs
+++ b/backend/windmill-worker/src/ruby_executor.rs
@@ -842,6 +842,7 @@ mount {{
             .envs(envs);
 
         cmd.args(&["main.rb"])
+            .stdin(Stdio::null())
             .stdout(Stdio::piped())
             .stderr(Stdio::piped());
 
diff --git a/backend/windmill-worker/src/rust_executor.rs b/backend/windmill-worker/src/rust_executor.rs
index b717c7d462..f47399c54a 100644
--- a/backend/windmill-worker/src/rust_executor.rs
+++ b/backend/windmill-worker/src/rust_executor.rs
@@ -573,6 +573,7 @@ pub async fn handle_rust_job(
             .env("TZ", TZ_ENV.as_str())
             .env("BASE_INTERNAL_URL", base_internal_url)
             .env("HOME", HOME_ENV.as_str())
+            .stdin(Stdio::null())
             .stdout(Stdio::piped())
             .stderr(Stdio::piped());