🛡️ Sentinel: [CRITICAL] Fix command injection in compile queue

.jules/sentinel.md

@@ -2,3 +2,8 @@
 **Vulnerability:** API endpoints in `backend/src/server.ts` taking user input (`projectId`, `jobId`) were directly joined with paths using `join` in `backend/src/store/localStore.ts` without proper sanitization. This allowed attackers to escape the project directory context and overwrite or read arbitrary files by sending payload containing `../` sequences.
 **Learning:** Even internal backend services handling project resources must securely sanitize all parameter values used for file operations to prevent path traversal outside expected boundaries.
 **Prevention:** Always use safe path sanitization utilities, like the implemented `safeJoin` and `toSafeRelativePath` in `backend/src/utils/path.ts`, to securely construct file paths and ensure the final path remains within the intended boundaries.
+
+## 2024-05-24 - [Command Option Injection in Compilation Worker]
+**Vulnerability:** The `compileQueue.ts` module forwarded the `mainFile` parameter straight into a request object payload that was sent to the `compile_worker` Rust tool. Since `mainFile` was placed immediately after `-output-directory` when executing `latexmk`, an attacker could supply a filename starting with a hyphen (like `-shell-escape`) to bypass the intended compilation logic and potentially perform remote code execution if parsed as a command argument.
+**Learning:** Option or Argument Injection can occur when user input starting with a `-` or `--` is passed to external binaries, even if the argument acts as a positional `target` argument in expected usage.
+**Prevention:** To prevent Option Injection, strictly block user inputs intended for filenames or other non-option parameters from starting with a hyphen, particularly before execution by `spawn` or Rust's `Command` execution modules.

backend/src/services/compileQueue.ts

@@ -101,6 +101,12 @@ export class CompileQueueService {
     const settings = await this.store.getSettings();
     const projectId = request.projectId.trim();
     const mainFile = request.mainFile?.trim() || "main.tex";
+
+    // Security: Prevent option injection (e.g., "-shell-escape") when passed to external binaries
+    if (mainFile.startsWith("-")) {
+      throw new HttpError(400, "mainFile cannot start with a hyphen.");
+    }
+
     const timeoutMs = request.timeoutMs ?? settings.compileTimeoutMs;
     const jobId = createId("job");