Post-Mortem on Command Execution in File Browser

Back in July, I made the decision to finally archive File Browser, and I won’t go over it again. In this post I want to address one category of features of File Browser that was the root of many of the security advisories that have been disclosed in the past year: command execution. When you hear that, bells start ringing immediately, since it sounds way too much like “remote code execution”, a very well known category of security vulnerabilities. I’m not a security specialist, so take all my opinions with a grain of salt. How It Started As I’ve mentioned in previous posts, File Browser did not start as a file manager. It started as a Caddy plugin for editing Hugo websites in the browser. In March 2016 I added a small box to its admin page where you could type a git command. You’d be able to edit a post and then very easily commit and push it without having to open your own terminal. A few months later, that box became a more general terminal-like feature with a list of allowed…