🛡️ Sentinel: [HIGH] Fix command injection in tool discovery

.jules/sentinel.md

@@ -0,0 +1,4 @@
+## 2024-05-20 - Command Injection via String Interpolation in Shell Wrappers
+**Vulnerability:** String interpolation used to inject dynamic variables into shell wrapper commands (`shell("/usr/bin/which \(tool)")`), leading to severe command injection vulnerabilities.
+**Learning:** Shell wrapper functions (like those calling `/bin/bash -c`) inherently trust the entire string passed to them, meaning any dynamically injected content can break out of the intended command structure if it contains shell metacharacters.
+**Prevention:** Avoid string interpolation in shell wrappers entirely. When dynamic inputs are required, execute the command directly using `Foundation.Process` (e.g., via `/usr/bin/env`) and pass the dynamic inputs strictly as elements in the `process.arguments` array.

Sources/Cacheout/Models/CacheCategory.swift

@@ -186,8 +186,23 @@ struct CacheCategory: Identifiable, Hashable {
     }
 
     private func toolExists(_ tool: String) -> Bool {
-        let result = shell("/usr/bin/which \(tool)")
-        return result != nil && !result!.isEmpty
+        let process = Process()
+        process.executableURL = URL(fileURLWithPath: "/usr/bin/env")
+        process.arguments = ["which", tool]
+        process.standardOutput = FileHandle.nullDevice
+        process.standardError = FileHandle.nullDevice
+        process.environment = [
+            "PATH": "/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin",
+            "HOME": FileManager.default.homeDirectoryForCurrentUser.path
+        ]
+
+        do {
+            try process.run()
+            process.waitUntilExit()
+            return process.terminationStatus == 0
+        } catch {
+            return false
+        }
     }
 
     private func runProbe(_ command: String) -> String? {