anupamme opened a new pull request, #313:
URL: https://github.com/apache/cordova-paramedic/pull/313
## Summary
Fix critical severity security issue in `lib/ParamediciOSPermissions.js`.
## Vulnerability
| Field | Value |
|-------|-------|
| **ID** | V-001 |
| **Severity** | CRITICAL |
| **Scanner** | multi_agent_ai |
| **Rule** | `V-001` |
| **File** | `lib/ParamediciOSPermissions.js:60` |
| **Assessment** | Likely exploitable |
| **CWE** | CWE-89 |
**Description**: The ParamediciOSPermissions.js module constructs SQL INSERT
and UPDATE statements using template literal string interpolation with the
${service} and ${app} variables. These variables are passed to the sqlite3
command-line tool without parameterization or escaping, allowing SQL injection
if an attacker controls these parameters.
## Evidence
**Exploitation scenario**: An attacker with filesystem write access to the
iOS simulator directory or control over parameters passed to the
ParamediciOSPermissions constructor could inject SQL metacharacters.
**Scanner confirmation**: multi_agent_ai rule `V-001` flagged this pattern.
**Production code**: This file is in the production codebase, not test-only
code.
## Threat Model Context
This is a Node.js library - vulnerabilities affect downstream consumers who
use this package.
## Changes
- `lib/ParamediciOSPermissions.js`
## Behavior Preservation
The change is scoped to 1 file on the vulnerable path, and the project's
existing tests still pass, so intended behavior is unchanged.
## Verification
- [x] Build passes
- [x] Scanner re-scan confirms fix
- [x] LLM code review passed
---
*Automated security fix by [OrbisAI Security](https://orbisappsec.com)*
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
