statulr/aurc

Fast Arch Linux Package Manger

💫 About Me:

Hi, I'm Statulr 👋

- 🌱 I’m currently a CS Student
- 😄 Pronouns: he/him
- 💻 Programmer

💻 Tech Stack:

📊 GitHub Stats:

✍️ Random Dev Quote

---

aurc's Issues

Vuln: Arbitrary command execution in package downloading

Here: https://github.com/statulr/aurc/blob/main/src/aurc_aur.c#L53 if the package name is something like this: &&funny_stuff this can be very easily be used for code execution.

This could be fixed in two ways:

1. Using the libcurl instead of system
2. Making sure the name is good by checking something like [a-Z0-9_-]+

Consistency

Hi I'm from @cloudzydev's stream.

One recommendation i can make you are using both camel case and snake case at the same time
interchangebly. Since you're writing for UNIX.
I suggest: Types are PascalCase Enums are UPPER_SNAKE
Variables are snake_case Functions are snake_case Also you use the Windows Format
for brackets not unix or gnu.

You can use formatters in Neovim:
Clang Format Options

Kernel Practices

Here is some example I made:

#pragma once

#include <stdheaders.h>

#include "yourheaders.h"

#define SOME_MACRO 5
const int SOME_CONST = 2;

enum {
    ENUM_T1,
    ENUM_T2,
} ENUM_TYPES;

// example code
struct MyType {
    int inner_field;
    union {
        /* */
    };
};

// Use namespaces on functions to prevent collision
void ns_printf(const char* fmt, void** args);

extern char* some_variable;

void ns_printf(const char* fmt, void** args)
{
    while (true) {
        if (false) {
        }
    }
}

Implement Libalpm and Libarchive

My attempts have been unsuccessful

What to do

Implement libalpm for package handling and libarchive for un-archiving things instead of going to the command-line

Once LibALPM is integrated to take care of AUR Package Installing, then it should be done, what is needed is when a user runs the install command instead of going to the shell, it will use the libalpm library to take care of it, and for unarchiving during installation it will use libarchive instead.

Resources I found

https://man.archlinux.org/man/libalpm_list.3.en
https://duckduckgo.com/?q=libalpm

TODO

[-] Implement LibALPM into the aurc_aur.c installaur function
[-] Implement libarchive into aurc_aur.c, and aur_pac.c for all archive related actions

Use fakeroot

Using fakeroot can be very beneficial so that when building, if a package is malicious, it cannot destroy your system.

On stream review

General

• SICK Graphics and I'm super impressed with the project

Security (strcmp vs strncmp)

• Technically you can run into buffer overflow/overrun issues with the str functions
• I'd recommend using their strn counterparts where you're required to specify a maximum size
• What is Buffer Overflow
• strncmp manpage

Security (Privilege Escalation)

• Code reference
• Technically speaking applications that have access to editing environment variables do not necessarily have sudo access
• As a result, you run the risk of privilege escalation if you have an app installed that modifies EDITOR to be some bash commands that it wants to run and you then run modifyRepo
• Generally would be safer to not rely on the environment variable here because they are modifiable by other applications
• Instead take a model similar to what git does with its editor where you configure it explicitly from the command line
  

Constants

• Might be worth trying to define your constants as const <type> <name> rather than macros

Early Return Design Pattern

• A lot of the time you have functions that are in the form of

if (cond) {
    // main logic
} else {
    // error handling
}

• Try out writing these as:

if (!cond) {
    // error handling
    return
}
// main logic

• It tends to be more readable and you might end up preferring it!

Comments

• We simply must comment less
• Try your hand at writing an entire file with zero comments
• Rely on variable names / function names to convey the context that you're trying to convey via comments
• This is just an exercise - we do not have to be this dogmatic long term. As a learning exercise I think it could help you grow as an engineer