🛡️ Sentinel: Fix pipe deadlock DoS in process execution - #94
Conversation
Co-authored-by: NSEvent <44446865+NSEvent@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
📝 WalkthroughWalkthroughThe changes reorder stdout and stderr pipe reads relative to ChangesProcess pipe ordering
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@XboxControllerMapper/XboxControllerMapperTests/OBSWebSocketLiveIntegrationTests.swift`:
- Around line 169-172: Update the process-launch flow around which.run() to
catch its failure and immediately throw XCTSkip or return before reading from
outPipe. Only call readDataToEndOfFile() and waitUntilExit() after which.run()
succeeds, preserving the existing terminationStatus handling for launched
processes.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 5e69fe41-6f26-4e42-8427-635858c920da
📒 Files selected for processing (2)
TriggerKit/Sources/TriggerKitRuntime/AutomationExecutor.swiftXboxControllerMapper/XboxControllerMapperTests/OBSWebSocketLiveIntegrationTests.swift
| try? which.run() | ||
| let data = outPipe.fileHandleForReading.readDataToEndOfFile() | ||
| which.waitUntilExit() | ||
| if which.terminationStatus == 0 { |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
sed -n '140,190p' XboxControllerMapper/XboxControllerMapperTests/OBSWebSocketLiveIntegrationTests.swiftRepository: NSEvent/xbox-controller-mapper
Length of output: 1989
Handle which.run() failures before reading the pipe. try? which.run() can leave the process unlaunched, and readDataToEndOfFile() will block waiting for EOF that never comes. Throw XCTSkip (or exit early) as soon as run() fails.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@XboxControllerMapper/XboxControllerMapperTests/OBSWebSocketLiveIntegrationTests.swift`
around lines 169 - 172, Update the process-launch flow around which.run() to
catch its failure and immediately throw XCTSkip or return before reading from
outPipe. Only call readDataToEndOfFile() and waitUntilExit() after which.run()
succeeds, preserving the existing terminationStatus handling for launched
processes.
1 participant
🚨 Severity: MEDIUM
💡 Vulnerability: When executing shell commands via
Foundation.Process, the app was waiting for the child process to exit before reading its output pipe. If the child process output exceeded the OS pipe buffer size (~64KB), the child would block waiting to write, and the parent would block waiting for the child to exit.🎯 Impact: This could result in a permanent deadlock and Denial of Service (DoS).
🔧 Fix: Swapped the order to read the pipe buffer
readDataToEndOfFile()before callingprocess.waitUntilExit().✅ Verification: Tested statically, verified syntax validity across modified swift files.
PR created automatically by Jules for task 365513411330066729 started by @NSEvent
Summary by CodeRabbit
Bug Fixes
Tests