🛡️ Sentinel: [HIGH] Fix argument injection in ffmpeg paths

[seonghobae]

🚨 Severity

HIGH

💡 Vulnerability

media_shrinker.py 파일 내 build_audio_plan, build_opus_plan, _build_lossy_plan 함수 등에서 ffmpeg 명령어 생성 시 파일 경로를 str(path) 형태로 상대 경로를 그대로 사용하였습니다. 이로 인해 파일명이 하이픈(-)으로 시작할 경우 옵션으로 오인되는 인자 주입(Argument Injection) 취약점이 존재했습니다.

🎯 Impact

악의적인 사용자가 하이픈으로 시작하는 파일명을 통해 임의의 명령어 인자를 주입할 수 있어 보안상 큰 위협이 될 수 있었습니다.

🔧 Fix

subprocess.run 호출 시 파일 경로 인자를 f"{path.resolve()}"로 변환하여 파일명을 절대 경로로 변경하였습니다. 이는 파일 경로가 root, drive 등으로 시작하게 하여 옵션으로 파싱되는 문제를 방지합니다.

✅ Verification

수정 사항이 인자 주입을 막는 것을 확인하기 위해 테스트 코드인 test_build_plans_use_absolute_paths_to_prevent_argument_injection를 추가하였고 모든 테스트가 정상적으로 100% 커버리지로 통과함을 검증하였습니다.

---

PR created automatically by Jules for task 10073886710074063526 started by @seonghobae

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[opencode-agent]

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

• Problem: Failed same-head checks remain for 69c7c9da907cd350618414ad934bb5944d0fc2b4.
• Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
• Fix: Read and fix the failed check logs below, then rerun the current-head checks.
• Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

• Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/codec-carver/actions/runs/29536859451/job/87750143391)
• Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/codec-carver/actions/runs/29536859451/job/87750143391)

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file: media_shrinker.py"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file: media_shrinker.py"]
  R1 --> V1["required checks"]
  Evidence --> S2["Test: test_media_shrinker.py"]
  S2 --> I2["regression suite"]
  I2 --> R2["Review risk: Test: test_media_shrinker.py"]
  R2 --> V2["targeted test run"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: 69c7c9da907cd350618414ad934bb5944d0fc2b4
• Workflow run: 29764633903
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

• Problem: Failed same-head checks remain for 69c7c9da907cd350618414ad934bb5944d0fc2b4.
• Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
• Fix: Read and fix the failed check logs below, then rerun the current-head checks.
• Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

• Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/codec-carver/actions/runs/29536859451/job/87750143391)
• Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/codec-carver/actions/runs/29536859451/job/87750143391)

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file: media_shrinker.py"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file: media_shrinker.py"]
  R1 --> V1["required checks"]
  Evidence --> S2["Test: test_media_shrinker.py"]
  S2 --> I2["regression suite"]
  I2 --> R2["Review risk: Test: test_media_shrinker.py"]
  R2 --> V2["targeted test run"]

Loading

[seonghobae]

Closing without merge because the reported command-injection path is already closed at the actual execution boundary. _execute_plan calls ConversionPlan.command(input_path=source, output_path=temp_output), and ConversionPlan.command replaces both paths with Path.resolve() values before subprocess.run(..., shell=False). The relative strings retained in the immutable plan template are not sent to ffmpeg in production. This PR therefore duplicates an existing regression test and changes planning representations without fixing a live sink. Future security findings must trace attacker input to the exact executed argv and demonstrate the failure before changing templates.

[google-labs-jules]

Closing without merge because the reported command-injection path is already closed at the actual execution boundary. _execute_plan calls ConversionPlan.command(input_path=source, output_path=temp_output), and ConversionPlan.command replaces both paths with Path.resolve() values before subprocess.run(..., shell=False). The relative strings retained in the immutable plan template are not sent to ffmpeg in production. This PR therefore duplicates an existing regression test and changes planning representations without fixing a live sink. Future security findings must trace attacker input to the exact executed argv and demonstrate the failure before changing templates.

Understood. Acknowledging that the reported command-injection path is already secured at the actual execution boundary and this work is obsolete. I will find a genuine security vulnerability.