[BUG] Shell Command Injection in Python Install Hooks

[EnthusiasticTech]

Project

vgrep

Description

In install.rs lines 383 and 406, Python hook files are generated with paths embedded directly using format!(). If the path contains quotes or shell metacharacters, the Python subprocess call could execute arbitrary commands.

Error Message

Debug Logs

System Information

Bounty Version: 0.1.0
OS: Ubuntu 24.04 LTS
CPU: AMD EPYC-Genoa Processor (8 cores)
RAM: 15 GB

Screenshots

No response

Steps to Reproduce

1. Create Factory Droid directory at a path with special chars: ~/.factory' && rm -rf / #/
2. Run vgrep install droid
3. Malicious Python hooks are generated
4. When hooks execute, arbitrary commands run

Expected Behavior

Paths properly escaped for shell execution

Actual Behavior

Paths embedded raw, allowing injection

Additional Context

No response

[echobt]

Issue validated. The reported problem has been confirmed in the codebase. A Pull Request with the fix has been submitted: CortexLM/vgrep#55.