Fix shell injection in jpseek analyzer via password field (#195)

* Initial plan

* Fix shell injection vulnerability in jpseek analyzer (CVE-style: command injection via password field)

- Replace bash -c with direct expect invocation
- Pass password via JPSEEK_PASS env variable to prevent injection
- Quote file paths with Tcl braces for safety
- Bump version to 3.2.1
- Add CHANGELOG.md

Agent-Logs-Url: https://github.com/Zeecka/AperiSolve/sessions/8c64fc67-869e-442e-9be9-ad2fef4ae738

Co-authored-by: Zeecka <24873615+Zeecka@users.noreply.github.com>

* Remove CHANGELOG.md

Agent-Logs-Url: https://github.com/Zeecka/AperiSolve/sessions/a5f3aa6c-72f5-48de-9cb6-65845bef19a1

Co-authored-by: Zeecka <24873615+Zeecka@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Zeecka <24873615+Zeecka@users.noreply.github.com>

aperisolve/analyzers/jpseek.py

@@ -16,16 +16,18 @@ class JpseekAnalyzer(SubprocessAnalyzer):
         """Build the jpseek command wrapped with expect for password support."""
         extracted_dir = self.get_extracted_dir()
         out = str(extracted_dir / "jpseek.out")
-        jpseek_cmd = f"jpseek {self.img} {out}"
         if password is None:
             password = ""
-        expect_cmd = (
+        # File paths are quoted with Tcl braces to prevent interpretation of
-            f"expect -c 'spawn {jpseek_cmd}; "
+        # special characters. The password is passed via an environment variable
-            f'expect "Passphrase:"; '
+        # (JPSEEK_PASS) to avoid any command injection through string interpolation.
-            f'send "{password}\\r"; '
+        expect_script = (
-            f"expect eof'"
+            f"spawn jpseek {{{self.img}}} {{{out}}}; "
+            'expect "Passphrase:"; '
+            'send "$env(JPSEEK_PASS)\\r"; '
+            "expect eof"
         )
-        return ["bash", "-c", expect_cmd]
+        return ["env", f"JPSEEK_PASS={password}", "expect", "-c", expect_script]
 
     def _remove_output_artifacts(self, output: str) -> str:
         extracted_dir = self.get_extracted_dir()

pyproject.toml

@@ -3,7 +3,7 @@
 
 [project]
 name = "aperisolve"
-version = "3.2.0"
+version = "3.2.1"
 description = "Open-source steganalysis web platform for automated image analysis and steganography detection"
 readme = "README.md"
 requires-python = ">=3.12"