fix(javascript-lang-security-detect-child-process-detect-child-process): Shell Injection via Unquoted Build Parameters in xcodebuild Command

[zepto-gaurav]

Optimus AutoFix — Automated Security Fix

Findings Fixed

Finding	Detector	Severity	File
Shell Injection via Unquoted Build Parameters in xcodebuild Command	javascript.lang.security.detect-child-process.detect-child-process	high	/tmp/scan_repo/scripts/releases/ios-prebuild/build.js

Fix Strategy

Shell Injection via Unquoted Build Parameters in xcodebuild Command

Changes Made

• /tmp/scan_repo/scripts/releases/ios-prebuild/build.js: Replace execSync with shell string interpolation with execFileSync (argument array form) to eliminate shell interpretation entirely. This is the correct fix for the root cause: the shell is never invoked, so no parameter — scheme, destination, buildFolder, configuration, or rootFolder — can ever be used to inject shell metacharacters. Before making changes, read the full file to confirm the existing require('child_process') import and check whether execSync is used anywhere else in the file.

Specific changes:

1. Update the require('child_process') destructuring at the top of the file to import execFileSync instead of (or in addition to, if execSync is used elsewhere) execSync.
2. In buildPlatform, delete the command string construction entirely.
3. Replace the execSync(command, {cwd: rootFolder, ...}) call with:

execFileSync(
  'xcodebuild',
  [
    '-scheme', scheme,
    '-destination', `generic/platform=${destination}`,
    '-derivedDataPath', buildFolder,
    '-configuration', configuration,
    'SKIP_INSTALL=NO',
    'BUILD_LIBRARY_FOR_DISTRIBUTION=YES',
    'DEBUG_INFORMATION_FORMAT=dwarf-with-dsym',
  ],
  {cwd: rootFolder, stdio: 'inherit'},
);

This covers ALL five interpolated values (scheme, destination, buildFolder, configuration, rootFolder) because none of them are ever passed through a shell. The fix is future-safe: any new arguments added to this invocation in the same array form will also bypass the shell.

AI Review

• Verdict: Approved
• Confidence: high
• Summary: The fix correctly addresses the root cause by replacing execSync (shell-based) with execFileSync (shell-bypassing argument array form). All five previously interpolated values — scheme, destination, buildFolder, configuration, and rootFolder — are now handled safely: the first four are passed as discrete array elements and rootFolder is passed only as the cwd option, never reaching a shell. The import is properly updated and no residual execSync references remain. The fix is minimal, syntactically correct, and preserves the exact behavioral semantics of the original invocation.

Issues

• [suggestion] The destination value is still embedded in a JavaScript template literal (generic/platform=${destination}). This is safe because the string is an array element passed directly to the OS without shell interpretation — but a code comment explaining this distinction could help future maintainers understand why the template literal here is not a concern, unlike the original shell-interpolated form.

Risk Assessment

• Risk Level: low
• Breaking Change: No
• Test Impact: Run the iOS prebuild pipeline with a known-good configuration to confirm xcodebuild still receives the correct arguments and the build succeeds. No unit tests are expected for a CI build script, but a smoke build against a real or stub workspace is sufficient validation.

---

Auto-generated by Optimus AutoFix Agent. Review carefully before merging.