runtime: harden external process invocation - #93
Merged
Gregory Joseph (gnjoseph) merged 3 commits intoAug 20, 2026
Merged
Conversation
Route all Azure CLI (az), Azure Developer CLI (azd), and local dev-server child processes through a single shared, shell-free launcher (src/proc-exec.ts) that resolves platform executable shims (including Windows .cmd/.bat) without spawning a command interpreter. Arguments are never passed through a shell, so shell metacharacters in user-influenced values can no longer alter the executed command line. Add strict allowlist validation for Azure subscription IDs and resource-group names, enforced at the tool boundary and re-asserted at the process-invocation boundary as defense-in-depth. Add focused unit/integration regression tests, including shell-metacharacter payloads and a valid GUID path. Valid inputs and existing behavior are unchanged. Adds cross-spawn (^7.0.6) runtime dependency and @types/cross-spawn dev dependency; regenerates package-lock.json and THIRD-PARTY-NOTICES; bumps the package to 0.2.0-alpha.2. AB#3116729 Copilot-Session-Id: 9b07fed7-d2cf-4209-8682-6c3004401c04 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Add durable offline coverage asserting both boundaries of the shell-free process launcher: 1) malformed, externally-influenced CLI identifiers are rejected before any spawn (validator throws/returns an error and the launcher is never invoked); and 2) every legal-but-shell-sensitive argument that reaches az/azd/npm stays a single discrete argv element with shell left falsy. New src/azure-cli.proc.test.ts exercises the proc-exec seam for listResourceGroups/resourceGroupExists/showSyntexProvider/registerSyntexProvider; proc-exec.test.ts and deploy-azure.test.ts gain punctuation-heavy discrete-argv cases. AB#3116729 Copilot-Session-Id: 9b07fed7-d2cf-4209-8682-6c3004401c04 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Replace illustrative command-name examples in the process-invocation safety fixtures with inert, punctuation-only tokens. Reject-before-spawn and discrete-argv coverage is preserved: every invalid token still trips the same allowlist branch, and valid legal-but-sensitive values are retained. AB#3116729 Copilot-Session-Id: 9b07fed7-d2cf-4209-8682-6c3004401c04 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Gregory Joseph (gnjoseph)
merged commit Aug 20, 2026
d637877
into
microsoft:feat/spe-mcp-server
5 of 6 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
0.2.0-alpha.2and add focused process-boundary regression coverageValidation
npm run ci- 893 passed, 7 skippednpm pack --dry-run-@microsoft/spe-mcp@0.2.0-alpha.2Reviewer notes
cross-spawnis promoted from a transitive dependency to a direct dependency so Windows command shims can be resolved without enabling shell parsing. Public fixtures use inert punctuation-only inputs.