🔒 Fix Command Execution Vulnerability in HTTP Requests

[undivisible]

🎯 What: The curl_get and curl_to_file functions in in-cli/src/package_install.rs used Command::new("curl") with arguments that could potentially allow command injection or arbitrary execution. They have been rewritten to use the native Rust HTTP client ureq.

⚠️ Risk: If a malicious URL is passed to the curl shell process, it could result in command injection, arbitrary code execution, or information disclosure. The command execution pattern is fragile and increases the surface area for attacks.

🛡️ Solution: The unsafe shell invocation using curl has been replaced with the native ureq HTTP client. By performing HTTP requests in-process using Rust's memory-safe ecosystem, we eliminate the need for shell spawning, mitigating command execution risks entirely while also increasing reliability. HTTP error statuses (4xx and 5xx) are explicitly verified since ureq v3 returns Ok(Response) for them.

---

PR created automatically by Jules for task 2916047929615634906 started by @undivisible

---

Note

Medium Risk
Changes how registry metadata and artifact downloads run (TLS, errors, no external curl), which affects cargo/npm/pypi/go install paths but removes shell-invocation risk.

Overview
Registry HTTP fetches no longer shell out to curl. curl_get and curl_to_file in package_install.rs now use an in-process ureq agent (shared user agent via get_http_agent()), while still enforcing HTTPS-only URLs.

Responses with status ≥ 400 are treated as errors explicitly, since ureq v3 can return Ok for failed statuses. The ureq dependency is added to Cargo.toml (and dev-dependencies); Cargo.lock picks up the TLS/HTTP stack (rustls, etc.).

^{Reviewed by Cursor Bugbot for commit f72a0f3. Configure here.}

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_5f30783d-256c-4eb2-9cda-aa175d1acbc1)

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request