Mitmproxy ingestes -- flags only in shell mode

[zner0L]

In order to pass the --set hardump option to mitmproxy, we need to set execa() to shell mode:

https://github.com/tweaselORG/cyanoacrylate/blob/5ae684cadd51e8bf76f569dddb9f868968687d6d/src/index.ts#L391

But since we pass user content (the addonPath) this strikes me as unsafe. We need to set the option, so there is no other way. Do you think it is enough to just resolve the paths using path.resolve() to sanitize them? I mean, in the end we allow users to set addons which execute any code they like so in this particular case I guess there is no added security risk?

[baltpeter]

I don't think that's true:

https://github.com/datenanfragen/android-data-safety-label-analysis/blob/e7cea9f5df4e0d212631760e04d784b8285eb7ed/src/traffic.ts#L92

This worked without --shell. Pretty sure the problem is the space, you have to split that into two arguments.

[zner0L]

Aaah, you're right! Thank you!