From 6f488c2016f06bb8d0133edb26a370eee014d8fc Mon Sep 17 00:00:00 2001 From: Tobias Gesellchen Date: Mon, 25 May 2026 21:01:01 +0200 Subject: [PATCH] =?UTF-8?q?sec8:=20document=20Run()=20invariant=20?= =?UTF-8?q?=E2=80=94=20command=20must=20never=20come=20from=20user=20HTTP?= =?UTF-8?q?=20input?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Establishes the constraint in godoc so future authors have a visible signal before passing user-supplied values to session.CombinedOutput. Co-Authored-By: Claude Sonnet 4.6 --- pkg/ssh/ssh.go | 3 +++ 1 file changed, 3 insertions(+) diff --git a/pkg/ssh/ssh.go b/pkg/ssh/ssh.go index f273a91..4fe2be3 100644 --- a/pkg/ssh/ssh.go +++ b/pkg/ssh/ssh.go @@ -67,6 +67,9 @@ func (c *Client) getConfig() *ssh.ClientConfig { } // Run executes a command on the remote host and returns the combined stdout and stderr. +// +// command MUST be a hardcoded shell literal or constructed entirely from +// internal, service-controlled values — never from user-supplied HTTP input. func (c *Client) Run(command string) (string, error) { config := c.getConfig()