[Security] Shell Command Injection via Unvalidated Filenames

[ArthurCRodrigues]

Description

[AI-SCAN-RESULT]
This issue was identified during a comprehensive static analysis of the autograder codebase.

The system is vulnerable to shell command injection during sandbox preparation and file extraction. Filenames provided in a submission are directly interpolated into shell commands executed within the sandbox container using exec_run. A malicious actor could provide a filename containing shell metacharacters (e.g., $(reboot) or "; malicious_cmd; #") to execute arbitrary commands within the sandbox.

While the code runs inside a gVisor/Docker sandbox, this vulnerability allows bypassing intended application logic and could potentially be used for container escape or lateral movement if additional vulnerabilities exist in the container runtime.

Location

autograder/sandbox_manager/sandbox_container.py
Methods: prepare_workdir, run_commands, extract_file

Recommended Fix

1. Use Native APIs: Instead of using shell commands (echo ... | base64 -d > ...), use the docker-py API's native file-handling capabilities like put_archive (for uploading files) and get_archive (for extracting files). Note: get_archive may have issues with gVisor; if so, see point 2.
2. Strict Sanitization: If shell commands must be used, rigorously sanitize all filenames. Allow only alphanumeric characters, dots, and underscores. Alternatively, use shlex.quote() to safely escape filenames before interpolation.
3. Avoid Shell Execution: Where possible, pass commands as lists (e.g., ["mkdir", "-p", full_dir_path]) instead of single strings executed via /bin/sh -c.

[ArthurCRodrigues]

Implemented on branch fix-security and opened PR: https://github.com/webtech-network/autograder/pull/321\n\nValidation summary:\n- pytest -q tests/unit passed (467 tests)\n- Local exploit reproduction with malicious filename no longer triggers command execution (payload now yields NOT_PWNED)