🛡️ Sentinel: [security improvement] Refactor dockerPrune to use direct binary execution

.jules/sentinel.md

@@ -0,0 +1,4 @@
+## 2024-05-24 - Avoid Shell Execution for External Commands
+**Vulnerability:** Invoking commands like `docker system prune` using a shell wrapper (`/bin/bash -c "..."`) instead of executing the binary directly exposes the application to command injection vulnerabilities, especially if any part of the command were to become dynamic. Using shell wrappers also complicates error handling and securely replicating shell features like redirection.
+**Learning:** Shell redirections like `2>&1` in shell commands can be securely replicated natively in Swift's Foundation `Process` without the need for an intermediate shell. This is done by assigning the identical `Pipe()` instance to both `process.standardOutput` and `process.standardError`. Using `URL(fileURLWithPath: "/usr/bin/env")` as the executable URL and passing the tool name as the first argument in `process.arguments` allows executing commands cleanly and directly while still respecting the `PATH` environment variable.
+**Prevention:** Always prefer direct binary execution via `Process` in Swift instead of using `/bin/bash -c` or similar shell wrappers. Pass all dynamic inputs explicitly as elements in the `process.arguments` array. If shell-specific features like output redirection are needed, implement them securely using the native `Process` configuration options rather than relying on shell syntax.

Sources/Cacheout/ViewModels/CacheoutViewModel.swift

@@ -231,8 +231,8 @@ class CacheoutViewModel: ObservableObject {
 
         let process = Process()
         let pipe = Pipe()
-        process.executableURL = URL(fileURLWithPath: "/bin/bash")
-        process.arguments = ["-c", "docker system prune -f 2>&1"]
+        process.executableURL = URL(fileURLWithPath: "/usr/bin/env")
+        process.arguments = ["docker", "system", "prune", "-f"]
         process.standardOutput = pipe
         process.standardError = pipe
         process.environment = [