Fix shell injection: use execFileSync with arg arrays instead of execSync with interpolated strings

.gitignore

@@ -0,0 +1 @@
+build/

Makefile

@@ -1,7 +1,9 @@
 SHELL		:= /bin/bash
 CC			:= cc
-CFLAGS := -Wall -O2
+MKDIR		:= mkdir
-TARGET := fa2json
+CFLAGS		:= -Wall -Werror -Os
+BUILD_DIR	:= build
+TARGET		:= $(BUILD_DIR)/fa2json
 SRCS		:= fs-watcher.c json-writer.c
 
 .PHONY: all test dev clean
@@ -9,6 +11,7 @@ SRCS   := fs-watcher.c json-writer.c
 all: $(TARGET)
 
 $(TARGET): $(SRCS)
+	$(MKDIR) -p $(BUILD_DIR)
 	$(CC) $(CFLAGS) -o $@ $^
 
 test: $(TARGET)
@@ -18,4 +21,4 @@ dev: $(TARGET)
 	node test/dev.mjs $(ARGS)
 
 clean:
-	rm -f $(TARGET)
+	rm -rf $(BUILD_DIR)

fs-watcher.c

@@ -58,7 +58,7 @@ static void handle_events(int fafd, int mount_fd) {
 				clock_gettime(CLOCK_MONOTONIC, &mono);
 				clock_gettime(CLOCK_REALTIME, &wall);
 
-				fprintf(stdout, "{\"ts\": [%i, %i, %i, %i]", wall.tv_sec, wall.tv_nsec, mono.tv_sec, mono.tv_nsec);
+				fprintf(stdout, "{\"ts\": [%li, %li, %li, %li]", wall.tv_sec, wall.tv_nsec, mono.tv_sec, mono.tv_nsec);
 
 				char *ptr = (char *)(metadata + 1);
 				char *end = (char *)metadata + metadata->event_len;
@@ -98,7 +98,7 @@ static void handle_events(int fafd, int mount_fd) {
 				}
 
 				if (entry_index++) { fprintf(stdout, ", "); }
-				fprintf(stdout, ", \"mask\": %i}\n", metadata->mask);
+				fprintf(stdout, ", \"mask\": %lli}\n", metadata->mask);
 
 				metadata = FAN_EVENT_NEXT(metadata, size);
 

test/lib/setup.mjs

@@ -1,34 +1,31 @@
-import { execSync, spawn } from 'node:child_process';
+import { execFileSync, spawn } from 'node:child_process';
-import { mkdtempSync, mkdirSync } from 'node:fs';
-import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 
-const FA2JSON = new URL('../../fa2json', import.meta.url).pathname;
+const FA2JSON = new URL('../../build/fa2json', import.meta.url).pathname;
 
 export async function setup() {
 	// Create image file and format
-	const img = execSync('mktemp /tmp/fa2json-test-XXXXXX.img').toString().trim();
+	const img = execFileSync('mktemp', ['/tmp/fa2json-test-XXXXXX.img']).toString().trim();
-	execSync(`truncate -s 10M ${img}`);
+	execFileSync('truncate', ['-s', '10M', img]);
-	execSync(`mkfs.ext4 -q ${img}`);
+	execFileSync('mkfs.ext4', ['-q', img]);
 
 	// Create mount point and mount
-	const mnt = execSync('mktemp -d /tmp/fa2json-mnt-XXXXXX').toString().trim();
+	const mnt = execFileSync('mktemp', ['-d', '/tmp/fa2json-mnt-XXXXXX']).toString().trim();
-	execSync(`sudo mount ${img} ${mnt}`);
+	execFileSync('sudo', ['mount', img, mnt]);
 
 	// Hand ownership to current user, then sync before fa2json starts
-	execSync(`sudo chown ${process.getuid()} ${mnt}`);
+	execFileSync('sudo', ['chown', String(process.getuid()), mnt]);
-	execSync('sync');
+	execFileSync('sync');
 
 	async function teardown() {
-		try { execSync(`sudo umount ${mnt}`); } catch {}
+		try { execFileSync('sudo', ['umount', mnt]); } catch {}
-		try { execSync(`rm -f ${img}`); } catch {}
+		try { execFileSync('rm', ['-f', img]); } catch {}
-		try { execSync(`rmdir ${mnt}`); } catch {}
+		try { execFileSync('rmdir', [mnt]); } catch {}
 	}
 
 	return { img, mnt, teardown };
 }
 
 export function spawnFa2json(mnt) {
-	const proc = spawn('sudo', [FA2JSON, mnt], { stdio: ['ignore', 'pipe', 'inherit'] });
+	return spawn('sudo', [FA2JSON, mnt], { stdio: ['ignore', 'pipe', 'inherit'] });
-	return proc;
 }