🛡️ Sentinel: [CRITICAL] Fix subprocess compilation RCE & DoS vulnerabilities

.jules/sentinel.md

@@ -7,3 +7,8 @@
 **Vulnerability:** The `CoverLetterGenerator` used a standard Jinja2 environment (intended for HTML/XML or plain text) to render LaTeX templates. This allowed malicious user input (or AI hallucinations) containing LaTeX control characters (e.g., `\input{...}`) to be injected directly into the LaTeX source, leading to potential Local File Inclusion (LFI) or other exploits.
 **Learning:** Jinja2's default `autoescape` is context-aware based on file extensions, but usually only for HTML/XML. It does NOT automatically escape LaTeX special characters. Relying on manual filters (like `| latex_escape`) in templates is error-prone and brittle, as developers might forget to apply them to every variable.
 **Prevention:** Always use a dedicated Jinja2 environment for LaTeX generation that enforces auto-escaping via a `finalize` hook (e.g., `tex_env.finalize = latex_escape`). This ensures *all* variable output is sanitized by default, providing defense-in-depth even if the template author forgets explicit filters.
+
+## 2025-02-28 - [Subprocess PDF Compilation RCE & DoS Security Enhancements]
+**Vulnerability:** Calling pdflatex and pandoc via subprocess.Popen without explicit timeouts or disabling shell-escape allows for potential Remote Code Execution (RCE) via malicious LaTeX documents, and infinite loops (DoS) if compilation hangs.
+**Learning:** Found that `cover_letter_generator.py` and `converter.py` invoked `pdflatex` and `pandoc` without `-no-shell-escape` flags and without checking `TimeoutExpired`. In contrast, `template.py` correctly passed `-no-shell-escape` flags and explicitly caught `subprocess.TimeoutExpired` to mitigate this.
+**Prevention:** Always pass `-no-shell-escape` directly to `pdflatex`, pass `--pdf-engine-opt=-no-shell-escape` to `pandoc`, and wrap `process.communicate()` with explicit timeouts, capturing `subprocess.TimeoutExpired`, calling `process.kill()`, and repeating `process.communicate()` to prevent double-free issues and zombie processes.

cli/generators/cover_letter_generator.py

@@ -771,12 +771,18 @@ def _compile_pdf(self, output_path: Path, tex_content: str) -> bool:
         try:
             # Use Popen with explicit cleanup to avoid double-free issues
             process = subprocess.Popen(
-                ["pdflatex", "-interaction=nonstopmode", tex_path.name],
+                ["pdflatex", "-interaction=nonstopmode", "-no-shell-escape", tex_path.name],
                 stdout=subprocess.PIPE,
                 stderr=subprocess.PIPE,
                 cwd=tex_path.parent,
             )
-            stdout, stderr = process.communicate()
+            try:
+                stdout, stderr = process.communicate(timeout=30)
+            except subprocess.TimeoutExpired:
+                process.kill()
+                stdout, stderr = process.communicate()
+                raise RuntimeError("PDF compilation timed out")
+
             if process.returncode == 0 or output_path.exists():
                 pdf_created = True
         except (subprocess.CalledProcessError, FileNotFoundError):
@@ -787,11 +793,24 @@ def _compile_pdf(self, output_path: Path, tex_content: str) -> bool:
                 # Fallback to pandoc
                 try:
                     process = subprocess.Popen(
-                        ["pandoc", str(tex_path), "-o", str(output_path), "--pdf-engine=xelatex"],
+                        [
+                            "pandoc",
+                            str(tex_path),
+                            "-o",
+                            str(output_path),
+                            "--pdf-engine=xelatex",
+                            "--pdf-engine-opt=-no-shell-escape",
+                        ],
                         stdout=subprocess.PIPE,
                         stderr=subprocess.PIPE,
                     )
-                    stdout, stderr = process.communicate()
+                    try:
+                        stdout, stderr = process.communicate(timeout=30)
+                    except subprocess.TimeoutExpired:
+                        process.kill()
+                        stdout, stderr = process.communicate()
+                        raise RuntimeError("PDF compilation timed out")
+
                     if process.returncode == 0 or output_path.exists():
                         pdf_created = True
                 except (subprocess.CalledProcessError, FileNotFoundError):

cli/pdf/converter.py

@@ -86,12 +86,17 @@ def _compile_pdflatex(
         """
         try:
             process = subprocess.Popen(
-                ["pdflatex", "-interaction=nonstopmode", tex_path.name],
+                ["pdflatex", "-interaction=nonstopmode", "-no-shell-escape", tex_path.name],
                 stdout=subprocess.PIPE,
                 stderr=subprocess.PIPE,
                 cwd=working_dir,
             )
-            stdout, stderr = process.communicate()
+            try:
+                stdout, stderr = process.communicate(timeout=30)
+            except subprocess.TimeoutExpired:
+                process.kill()
+                stdout, stderr = process.communicate()
+                raise RuntimeError("PDF compilation timed out")
 
             if process.returncode == 0 or output_path.exists():
                 return True
@@ -121,12 +126,24 @@ def _compile_pandoc(
         """
         try:
             process = subprocess.Popen(
-                ["pandoc", str(tex_path), "-o", str(output_path), "--pdf-engine=xelatex"],
+                [
+                    "pandoc",
+                    str(tex_path),
+                    "-o",
+                    str(output_path),
+                    "--pdf-engine=xelatex",
+                    "--pdf-engine-opt=-no-shell-escape",
+                ],
                 stdout=subprocess.PIPE,
                 stderr=subprocess.PIPE,
                 cwd=working_dir,
             )
-            stdout, stderr = process.communicate()
+            try:
+                stdout, stderr = process.communicate(timeout=30)
+            except subprocess.TimeoutExpired:
+                process.kill()
+                stdout, stderr = process.communicate()
+                raise RuntimeError("PDF compilation timed out")
 
             if process.returncode == 0 or output_path.exists():
                 return True
@@ -148,7 +165,11 @@ def is_pdflatex_available(self) -> bool:
                 stdout=subprocess.PIPE,
                 stderr=subprocess.PIPE,
             )
-            process.communicate()
+            try:
+                process.communicate(timeout=10)
+            except subprocess.TimeoutExpired:
+                process.kill()
+                process.communicate()
             return process.returncode == 0
         except FileNotFoundError:
             return False
@@ -166,7 +187,11 @@ def is_pandoc_available(self) -> bool:
                 stdout=subprocess.PIPE,
                 stderr=subprocess.PIPE,
             )
-            process.communicate()
+            try:
+                process.communicate(timeout=10)
+            except subprocess.TimeoutExpired:
+                process.kill()
+                process.communicate()
             return process.returncode == 0
         except FileNotFoundError:
             return False