From 1c9fd17d0f4db3fbbdae88644f35d985b553a214 Mon Sep 17 00:00:00 2001 From: "google-labs-jules[bot]" <161369871+google-labs-jules[bot]@users.noreply.github.com> Date: Fri, 4 Sep 2026 07:11:35 +0000 Subject: [PATCH] =?UTF-8?q?=F0=9F=94=92=20fix=20argument=20injection=20vul?= =?UTF-8?q?nerability=20in=20speedtest=20server=20parameter?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Validates that the user-provided `--speedtest-server` parameter does not start with a hyphen (`-`) before passing it to `asyncio.create_subprocess_exec` in `tier_ookla`. This prevents option injection vulnerabilities where a malicious user or external script could supply flags (e.g. `--hacked`) that the `speedtest` binary would process. Also adds a test case to prevent regression. Co-authored-by: Horizontal42 <75383519+Horizontal42@users.noreply.github.com> --- src/netsleuth/speed.py | 3 +++ tests/test_speed.py | 9 +++++++++ 2 files changed, 12 insertions(+) diff --git a/src/netsleuth/speed.py b/src/netsleuth/speed.py index 505e1f0..d8534c8 100644 --- a/src/netsleuth/speed.py +++ b/src/netsleuth/speed.py @@ -124,6 +124,9 @@ async def tier_ookla( iface_name: str | None = None, ipv4: str | None = None, ) -> SpeedResult: + if server and server.startswith("-"): + raise ValueError("Invalid server argument: cannot start with '-'") + args = [binary, "--format=json", "--accept-license", "--accept-gdpr"] args += ookla_interface_args(iface_name, ipv4) if server: diff --git a/tests/test_speed.py b/tests/test_speed.py index 3722359..78699d5 100644 --- a/tests/test_speed.py +++ b/tests/test_speed.py @@ -287,6 +287,15 @@ async def test_tier_ookla_success_parses_json(): assert result.idle_rtt_ms == 15.5 + + +async def test_tier_ookla_server_argument_injection(): + with pytest.raises( + ValueError, match="Invalid server argument: cannot start with '-'" + ): + await tier_ookla("speedtest", "--hacked", 10.0) + + async def test_tier_ookla_server_args(): mock_proc = AsyncMock() mock_payload = {}