mock keystone forwarder with deployment scripts #239
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| src/v0.8/keystone/MockKeystoneForwarder.sol:MockKeystoneForwarder`; | ||
|
|
||
| console.log("\nRunning verification..."); | ||
| execSync(cmd, { stdio: 'inherit' }); |
Check warning
Code scanning / CodeQL
Indirect uncontrolled command line Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 7 days ago
The problem can be fixed by avoiding passing a single shell command string to execSync, and instead using an API that invokes a binary directly with list-of-arguments, such as execFileSync. This prevents any shell metacharacter interpretation and so avoids injection. In this case, we replace:
const cmd = `cd contracts && forge verify-contract ...`
execSync(cmd, { stdio: 'inherit' });with
execFileSync('forge', [...args], { cwd: 'contracts', stdio: 'inherit' });where args is an array of all the arguments previously included as part of the string, including all flags and parameter values. Arguments are split exactly as would have been split by the shell, except that environment variable interpolation is replaced by direct use.
If the use of cd contracts && ... was simply to change the working directory, the equivalent for execFileSync is to set the third argument's cwd property to contracts.
Thus, the only changes required are:
- Require
execFileSyncfromchild_process(possibly already available asexecSyncis already imported; add if not). - Construct the arguments for the
forge verify-contractcall as an array. - Invoke
execFileSyncinstead ofexecSync, passing in 'forge' and the argument array, with{ cwd: 'contracts', stdio: 'inherit' }.
No new dependencies are needed.
| @@ -1,5 +1,5 @@ | ||
| const fs = require("fs"); | ||
| const { execSync } = require("child_process"); | ||
| const { execSync, execFileSync } = require("child_process"); | ||
|
|
||
| // Try to load dotenv if available | ||
| try { | ||
| @@ -44,16 +44,18 @@ | ||
| console.log("\nWaiting 3 seconds to avoid rate limit..."); | ||
| await new Promise(resolve => setTimeout(resolve, 3000)); | ||
|
|
||
| const cmd = `cd contracts && forge verify-contract \ | ||
| --chain sepolia \ | ||
| --etherscan-api-key ${process.env.ETHERSCAN_API_KEY} \ | ||
| --watch \ | ||
| --retry 3 \ | ||
| ${contractAddress} \ | ||
| src/v0.8/keystone/MockKeystoneForwarder.sol:MockKeystoneForwarder`; | ||
| const forgeArgs = [ | ||
| 'verify-contract', | ||
| '--chain', 'sepolia', | ||
| '--etherscan-api-key', process.env.ETHERSCAN_API_KEY, | ||
| '--watch', | ||
| '--retry', '3', | ||
| contractAddress, | ||
| 'src/v0.8/keystone/MockKeystoneForwarder.sol:MockKeystoneForwarder' | ||
| ]; | ||
|
|
||
| console.log("\nRunning verification..."); | ||
| execSync(cmd, { stdio: 'inherit' }); | ||
| execFileSync('forge', forgeArgs, { cwd: 'contracts', stdio: 'inherit' }); | ||
|
|
||
| console.log("\n✅ Contract verified successfully!"); | ||
| console.log(`View on Sepolia Etherscan: https://sepolia.etherscan.io/address/${contractAddress}#code`); |
Static analysis results are availableHey @akhilchainani, you can view Slither reports in the job summary here or download them as artifact here. |
No description provided.