CVE-2020-15123 (Other, published 2020-07-20T18:15Z)
Description: value: In codecov (npm package) before version 3.7.1 the upload method has a command injection vulnerability. Clients of the codecov-node library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability. A similar CVE (CVE-2020-7597 for GHSA-5q88-cjfq-g2mh) was issued but the fix was incomplete. It only blocked &, and command injection is still possible using backticks instead to bypass the sanitizer. The attack surface is low in this case. Particularly in the standard use of codecov, where the module is used directly in a build pipeline, not built against as a library in another application that may supply malicious input and perform command injection.
Severity: MEDIUM (CVSS v3 base score: 9.3)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/codecov/codecov-node
Files changed:
.idea/.gitignore
README.md
lib/codecov.js
Commit message: Switch from execSync to execFileSync (#180)

* Switch from execSync to execFileSync

* Call existsSync instead of executing `if`

* Trigger a build

* I think this fixes linux and macos...

* Only add more_patterns of it has a value. Correct windows.

* Remove default value to more_patterns, change windows to winPatterns

* Try a colon.

* Let's try not using MinGw...

* What are the chances that Windows has a find?

* Put it back

* Reverting Windows side so this can me merged in time if needed.

* Reverting Windows side so this can me merged in time if needed.

* Update lib/codecov.js

Co-authored-by: Guillaume St-Pierre <guillaume@codecov.io>

* Update lib/codecov.js

Co-authored-by: Guillaume St-Pierre <guillaume@codecov.io>

* Set initial values

Co-authored-by: Guillaume St-Pierre <guillaume@codecov.io>

Vulnerable code:
var patterns,
  more_patterns = ''
  patterns =
    "-type f \\( -name '*coverage.*' " +
    "-or -name '*.lst' \\) " +
  patterns =
    '/a-d /b /s *coverage.* ' +
      execSync('git ls-files || hg locate', { cwd: root })
      execSync(gcov)
    bowerrc = execSync('if exist .bowerrc type .bowerrc', { cwd: root })
      .toString()
      .trim()
        more_patterns =
          " -not -path '*/" + bowerrc.toString().replace(/\/$/, '') + "/*'"
        more_patterns =
          '| findstr /i /v \\' + bowerrc.toString().replace(/\/$/, '') + '\\'
      _files = execSync('find ' + root + ' ' + patterns + more_patterns)
      _files = execSync('dir ' + patterns + more_patterns)

Fixed code:
# Default ignored files
/shelf/
/workspace.xml
# Editor-based HTTP Client requests
/httpRequests/

.idea/

.
var execFileSync = require('child_process').execFileSync
var patterns = ''
var more_patterns = ''
var winPatterns = ''
  patterns = (
    "-type f -name '*coverage.*' " +
    "-or -name '*.lst' " +
  ).split(' ')
  winPatterns = (
    '/a:-d /b /s *coverage.* ' +
  ).split(' ')
      execFileSync('git', ['ls-files', '||', 'hg', 'locate'], { cwd: root })
      execFileSync(gcov)
    bowerrc = fs.existsSync('.bowerrc')
        more_patterns = (
          " -not -path '*/" +
          bowerrc.toString().replace(/\/$/, '') +
          "/*'"
        ).split(' ')
        more_patterns = (
          '| findstr /i /v \\' +
          bowerrc.toString().replace(/\/$/, '') +
          '\\'
        ).split(' ')
    var _findArgs
      // @TODO support for a root directory
      // It's not straightforward due to the nature of the find command
      _findArgs = [root].concat(patterns)
      if (more_patterns) {
        _findArgs.concat(more_patterns)
      }
      _files = execFileSync('find', _findArgs)
      _findArgs = [root].concat(winPatterns)
      if (more_patterns) {
        _findArgs.concat(more_patterns)
      }
      _files = execSync('dir ' + winPatterns.join(' ') + more_patterns)