fix(rce): security fix regarding open PATH environment

CONTRIBUTING.md

@@ -11,7 +11,8 @@ If you are 100% new to Github, you can go to Google or Youtube and lookup about
 collaborate with people in Github. Some of our favorites are:
 
 * [Git It? How to use Git and Github](https://www.youtube.com/watch?v=HkdAHXoRtos) by Fireship (Youtube)
-* [Git and GitHub for Beginners - Crash Course](https://www.youtube.com/watch?v=RGOj5yH7evk) by freeCodeCamp.org (Youtube)
+* [Git and GitHub for Beginners - Crash Course](https://www.youtube.com/watch?v=RGOj5yH7evk) by freeCodeCamp.org (
+  Youtube)
 * [How to Contribute to Open Source](https://opensource.guide/how-to-contribute/) by Open Source Guide (article)
 * [Learn Git & GitHub](https://www.codecademy.com/learn/learn-git) by Codecademy (Paid online course)
 
@@ -47,8 +48,8 @@ whether the idea has already been proposed on the [issue list](https://github.co
 This is basically the hardest contribution you can do, because writing technical or non-technical documentation
 is always a challenge for us developers.
 
-You can help by documenting everything. Create how-tos, create in-code documentation (what the function does, why X is here, etc),
-or even fixing some typos (including some that may exist on this document). But, please bear in mind that 
+You can help by documenting everything. Create how-tos, create in-code documentation (what the function does, why X is
+here, etc), or even fixing some typos (including some that may exist on this document). But, please bear in mind that
 documentation should be easy to understand (by using simple English) and should be accessible to everyone.
 You don't want people to ask you over and over again for something that only some people understand.
 
@@ -59,8 +60,8 @@ Finally, this is what most developers can help, by code.
 We use multiple programming language to bring Pesto to life. Please read each README on the submodule that
 you are interested in to have detailed explanation on how to contribute to each specific module.
 
-All services (or modules) are deployed on a cloud VPS using Docker. The Docker images are built on Github Actions and pushed
-to the Github Contianer Registry. On each commit push to master, it will trigger a deployment action that will SSH to the VPS
-and trigger a pull for new image.
+All services (or modules) are deployed on a cloud VPS using Docker. The Docker images are built on GitHub Actions and
+pushed to the Github Contianer Registry. On each commit push to master, it will trigger a deployment action that will
+SSH to the VPS and trigger a pull for new image.
 
 We are waiting for your contribution!

README.md

@@ -1,11 +1,18 @@
 # Pesto - Remote Code Execution Engine
 
-**Pesto** is a Remote Code Execution Engine that lets you execute any piece of code on a remote server via REST API. It is heavily inspired by [Piston](https://github.com/engineer-man/piston). Pesto is not a fork of Piston, it's an entire rewrite from scratch and therefore it's not compatible with Piston but should be similar if you're already familiar with Piston.
+**Pesto** is a Remote Code Execution Engine that lets you execute any piece of code on a remote server via REST API. It
+is heavily inspired by [Piston](https://github.com/engineer-man/piston). Pesto is not a fork of Piston, it's an entire
+rewrite from scratch and therefore it's not compatible with Piston but should be similar if you're already familiar with
+Piston.
 
-Pesto was written with a fresh start, minimizing the dependencies needed, and system controlled for limited resources usage. Hence, users will need to register in order to gain access to Pesto's API.
-
-Pesto API itself is hosted on our cloud VPS in Singapore, backed by the contributions on our donators from [Saweria](https://saweria.co/teknologiumum) (Indonesian only) and [Github Sponsors](https://github.com/sponsors/teknologi-umum) (Worldwide). The API is 100% free to use. However, if you are using Pesto API on a commercial project or on a project that makes money to you, please consider donating to keep the API running.
+Pesto was written with a fresh start, minimizing the dependencies needed, and system controlled for limited resources
+usage. Hence, users will need to register in order to gain access to Pesto's API.
 
+Pesto API itself is hosted on our cloud VPS in Singapore, backed by the contributions on our donators
+from [Saweria](https://saweria.co/teknologiumum) (Indonesian only)
+and [Github Sponsors](https://github.com/sponsors/teknologi-umum) (Worldwide). The API is 100% free to use. However, if
+you are using Pesto API on a commercial project or on a project that makes money to you, please consider donating to
+keep the API running.
 
 See [our website](https://pesto.teknologiumum.com) for details.
 
@@ -28,9 +35,17 @@ Are you using Pesto on your project, if so, please put it here!
 
 ## Contributing
 
-General contribution guidelines are on [CONTRIBUTING.md](./CONTRIBUTING.md), yet if you choose to do a code contribution, please refer to the README file on each submodule that you are interested in. We are looking forward for your contribution.
+General contribution guidelines are on [CONTRIBUTING.md](./CONTRIBUTING.md), yet if you choose to do a code
+contribution, please refer to the README file on each submodule that you are interested in. This repository may seem
+daunting for newcomers, but rest assured, we're all friendly and we welcome any contributions whether it's just a typo
+fix, a package version bump, or a security enhancement for one of Pesto's package. We are looking forward for your
+contribution.
+
+Please use [issues](https://github.com/teknologi-umum/pesto/issues) to file a bug or discuss any matter before
+contributing to the source code.
 
-Please use [issues](https://github.com/teknologi-umum/pesto/issues) to file a bug or discuss any matter before contributing to the source code.
+If you need additional help, you can always talk to us via [Telegram](https://t.me/teknologi_umum_v2)
+or [Discord](https://discord.gg/b3JRrGuxR6).
 
 ## License
 

rce/Dockerfile

@@ -7,13 +7,24 @@ WORKDIR /app
 COPY . .
 
 RUN apt-get update && \
+  # Update OS dependencies \
   apt-get upgrade -y && \
-  apt-get install -y coreutils binutils build-essential libseccomp-dev gcc apt-utils curl tar bzip2 gzip && \
+  apt-get install -y coreutils binutils build-essential libseccomp-dev gcc \
+    apt-utils curl tar bzip2 gzip make cmake zip unzip autoconf pkg-config \
+    flex perl sed clang && \
+  # Prohibits network access
   make -C ./nosocket/ all && make -C ./nosocket/ install && \
   npm ci && \
+  # We install packages here
   node ./scripts/install.cjs && \
+  # Remove installed build steps via apt just to lessen the image size more \
+  apt-get remove -y gcc tar gzip bzip2 make cmake zip unzip autoconf pkg-config \
+    flex perl sed clang && \
+  # Create OS users
   node ./scripts/register-users.cjs && \
+  # Build the application
   npm run build && \
+  # Remove every dependencies, install runtime-only
   rm -rf node_modules && npm ci --omit=dev && \
   apt-get autoremove -y && apt-get clean -y && \
   rm -rf /var/lib/apt/lists/*

rce/packages/brainfuck/install.sh

@@ -1,7 +1,6 @@
 #!/usr/bin/env bash
 
-apt-get update
-apt-get install -y libedit-dev cmake
+apt-get install -y libedit-dev
 curl -LO https://github.com/fabianishere/brainfuck/archive/refs/tags/2.7.3.tar.gz
 tar -zxf 2.7.3.tar.gz
 mkdir -p brainfuck-2.7.3/build

rce/packages/c++/config.toml

@@ -15,7 +15,7 @@ build_command = [
     "{file}"
 ]
 environment = [
-  "PATH=/opt/gcc/12.2.0/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+  "PATH=/opt/gcc/12.2.0/bin",
   "LD_LIBRARY_PATH=/opt/gcc/12.2.0/lib64",
   "CC=/opt/gcc/12.2.0/bin/gcc",
   "CXX=/opt/gcc/12.2.0/bin/g++",

rce/packages/c++/install.sh

@@ -4,8 +4,7 @@ if [ -d "/opt/gcc/12.2.0/" ]; then
   exit 0
 fi
 
-apt-get update
-apt-get install -y gcc build-essential libc6-dev dpkg-dev autoconf flex curl tar gzip
+apt-get install -y libc6-dev dpkg-dev
 
 cd ~
 
@@ -27,5 +26,3 @@ make install-strip -j $(nproc)
 cd ..
 
 rm -rf build gcc*
-
-apt-get remove -y gcc

rce/packages/c/config.toml

@@ -15,7 +15,7 @@ build_command = [
     "{file}"
 ]
 environment = [
-  "PATH=/opt/gcc/12.2.0/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+  "PATH=/opt/gcc/12.2.0/bin",
   "LD_LIBRARY_PATH=/opt/gcc/12.2.0/lib64:$LD_LIBRARY_PATH",
   "CC=/opt/gcc/12.2.0/bin/gcc",
   "CXX=/opt/gcc/12.2.0/bin/g++",

rce/packages/c/install.sh

@@ -4,8 +4,7 @@ if [ -d "/opt/gcc/12.2.0/" ]; then
   exit 0
 fi
 
-apt-get update
-apt-get install -y gcc build-essential libc6-dev dpkg-dev autoconf flex curl tar gzip
+apt-get install -y libc6-dev dpkg-dev
 
 cd ~
 
@@ -27,5 +26,3 @@ make install-strip -j $(nproc)
 cd ..
 
 rm -rf build gcc*
-
-apt-get remove -y gcc

rce/packages/clisp/config.toml

@@ -3,7 +3,7 @@ version = "2.2.7"
 compiled = false
 extension = "cl"
 build_command = []
-environment = [ "SBCL_HOME=/opt/sbcl/2.2.7/lib/sbcl", "PATH=/opt/sbcl/2.2.7:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" ]
+environment = [ "SBCL_HOME=/opt/sbcl/2.2.7/lib/sbcl", "PATH=/opt/sbcl/2.2.7" ]
 run_command = [ "/opt/sbcl/2.2.7/bin/sbcl", "--script", "{file}" ]
 test_file = "test.cl"
 aliases = ["clisp", "sbcl"]

rce/packages/dotnet/config.toml

@@ -2,7 +2,7 @@ language = ".NET"
 version = "6.0.300"
 compiled = true
 extension = "cs"
-environment = [ "DOTNET_ROOT=/opt/dotnet/6.0.300", "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/dotnet/6.0.300" ]
+environment = [ "DOTNET_ROOT=/opt/dotnet/6.0.300", "PATH=/opt/dotnet/6.0.300" ]
 build_command = [
   """bash -c 'cat <<EOF > Application.csproj
 <Project Sdk="Microsoft.NET.Sdk">

rce/packages/dotnet/install.sh

@@ -2,7 +2,6 @@
 
 VERSION="6.0.300"
 
-apt-get update \
 apt-get install -y --no-install-recommends \
     libc6 \
     libgcc1 \

rce/packages/elixir-1.14/config.toml

@@ -2,7 +2,7 @@ language = "Elixir"
 version = "1.14.1"
 compiled = false
 extension = "exs"
-environment = [ "PATH=/opt/elixir/1.14/bin:/opt/erlang/25/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" ]
+environment = [ "PATH=/opt/elixir/1.14/bin:/opt/erlang/25/bin" ]
 build_command = []
 run_command = [ "elixir", "{file}" ]
 test_file = "test.exs"

rce/packages/erlang-25/config.toml

@@ -2,7 +2,7 @@ language = "Erlang"
 version = "25.1.2"
 compiled = false
 extension = "erl"
-environment = [ "PATH=/opt/erlang/25/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" ]
+environment = [ "PATH=/opt/erlang/25/bin" ]
 build_command = []
 run_command = [ "escript", "{file}" ]
 test_file = "test.erl"

rce/packages/erlang-25/install.sh

@@ -5,8 +5,7 @@ if [[ -d "/opt/erlang/25" ]]; then
 fi
 
 cd ~
-apt-get update
-apt-get install -y ncurses-bin libncurses-dev perl sed gcc make clang
+apt-get install -y ncurses-bin libncurses-dev
 curl -LO https://github.com/erlang/otp/releases/download/OTP-25.1.2/otp_src_25.1.2.tar.gz
 tar -zxf otp_src_25.1.2.tar.gz
 mkdir -p /opt/erlang/25/

rce/packages/go/config.toml

@@ -5,7 +5,7 @@ extension = "go"
 build_command = [ "/opt/go/1.20/go/bin/go", "build", "-o", "code", "{file}"]
 run_command = [ "./code" ]
 test_file = "test.go"
-environment = [ "GOPATH=/opt/go/1.20/go", "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/go/1.20/go/bin" ]
+environment = [ "GOPATH=/opt/go/1.20/go", "PATH=/opt/go/1.20/go/bin" ]
 aliases = [ "go", "golang" ]
 should_limit_memory = false
 memory_limit = 0

rce/packages/janet/config.toml

@@ -4,9 +4,7 @@ compiled = false
 extension = "janet"
 build_command = []
 run_command = [ "janet", "{file}" ]
-environment = [
-  "PATH=/opt/janet/v1.27.0/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
-]
+environment = [ "PATH=/opt/janet/v1.27.0/bin" ]
 test_file = "test.janet"
 aliases = ["janet"]
 should_limit_memory = true

rce/packages/janet/install.sh

@@ -2,9 +2,6 @@
 
 VERSION="1.27.0"
 
-apt-get update
-apt-get install -y make gcc build-essential
-
 curl -LO https://github.com/janet-lang/janet/archive/refs/tags/v${VERSION}.tar.gz
 tar -zxf v${VERSION}.tar.gz
 cd janet-${VERSION}/

rce/packages/java/config.toml

@@ -8,7 +8,7 @@ build_command = [
 ]
 run_command = [ "java", "-Xms64m", "-Xmx256m", "{file}" ]
 environment = [
-  "PATH=/opt/java/17/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+  "PATH=/opt/java/17/bin",
   "JAVA_HOME=/opt/java/17",
   "JAVA_VERSION=17.0.5",
   "LIBC=gnu"

rce/packages/javascript-16/config.toml

@@ -2,7 +2,7 @@ language = "Javascript"
 version = "16.15.0"
 compiled = false
 extension = "js"
-environment = [ "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/node/16.15.0/bin"]
+environment = [ "PATH=/opt/node/16.15.0/bin"]
 build_command = []
 run_command = [ "/opt/node/16.15.0/bin/node", "{file}" ]
 test_file = "test.js"

rce/packages/javascript-18/config.toml

@@ -2,7 +2,7 @@ language = "Javascript"
 version = "18.12.1"
 compiled = false
 extension = "js"
-environment = [ "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/node/18.12.1/bin"]
+environment = [ "PATH=/opt/node/18.12.1/bin"]
 build_command = []
 run_command = [ "/opt/node/18.12.1/bin/node", "{file}" ]
 test_file = "test.js"

rce/packages/julia/config.toml

@@ -2,7 +2,7 @@ language = "Julia"
 version = "1.7.3"
 compiled = false
 extension = "jl"
-environment = [ "PATH=/opt/julia/1.7/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"]
+environment = [ "PATH=/opt/julia/1.7/bin" ]
 build_command = []
 run_command = [ "/opt/julia/1.7/bin/julia", "{file}" ]
 test_file = "test.jl"

rce/packages/lua/config.toml

@@ -2,7 +2,7 @@ language = "Lua"
 version = "5.4.4"
 compiled = false
 extension = "lua"
-environment = [ "PATH=/opt/lua/5.4/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" ]
+environment = [ "PATH=/opt/lua/5.4/bin" ]
 build_command = []
 run_command = [ "/opt/lua/5.4/bin/lua", "{file}" ]
 test_file = "test.lua"

rce/packages/php/config.toml

@@ -2,7 +2,7 @@ language = "PHP"
 version = "8.1"
 compiled = false
 extension = "php"
-environment = [ "PATH=/opt/php/8.1/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" ]
+environment = [ "PATH=/opt/php/8.1/bin" ]
 build_command = []
 run_command = [ "php", "{file}" ]
 test_file = "test.php"

rce/packages/php/install.sh

@@ -1,8 +1,7 @@
 #!/usr/bin/env bash
 
 cd ~
-apt-get update
-apt-get install -y make autoconf build-essential curl libtool libssl-dev libcurl4-openssl-dev libxml2-dev libreadline8 libreadline-dev libzip-dev libzip4 openssl pkg-config zlib1g-dev
+apt-get install -y libtool libssl-dev libcurl4-openssl-dev libxml2-dev libreadline8 libreadline-dev libzip-dev libzip4 openssl zlib1g-dev
 curl -LO https://www.php.net/distributions/php-8.1.13.tar.gz
 tar -zxf php-8.1.13.tar.gz
 cd php-8.1.13

rce/packages/python/config.toml

@@ -2,7 +2,7 @@ language = "Python"
 version = "3.10.10"
 compiled = false
 extension = "py"
-environment = [ "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/python/3.10.10/bin" ]
+environment = [ "PATH=/opt/python/3.10.10/bin" ]
 build_command = []
 run_command = [ "/opt/python/3.10.10/bin/python3", "{file}" ]
 test_file = "test.py"

rce/packages/ruby/config.toml

@@ -2,7 +2,7 @@ language = "Ruby"
 version = "3.2.1"
 compiled = false
 extension = "rb"
-environment = [ "PATH=/opt/ruby/3.2/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"]
+environment = [ "PATH=/opt/ruby/3.2/bin"]
 build_command = []
 run_command = [ "/opt/ruby/3.2/bin/ruby", "{file}" ]
 test_file = "test.rb"

rce/packages/ruby/install.sh

@@ -7,7 +7,7 @@ curl -LO https://cache.ruby-lang.org/pub/ruby/${MINOR}/ruby-${VERSION}.tar.gz
 tar -zxf ruby-${VERSION}.tar.gz
 cd ruby-${VERSION}
 mkdir -p /opt/ruby/${MINOR}
-./configure --prefix=/opt/ruby/$MINOR
+./configure --prefix=/opt/ruby/$MINOR --disable-install-doc
 make -j $(nproc)
 make install -j $(nproc)
 cd ..

rce/packages/sqlite3/config.toml

@@ -3,7 +3,7 @@ version = "3.34.1"
 compiled = false
 extension = "sql"
 environment = [
-  "PATH=/opt/sqlite3/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+  "PATH=/opt/sqlite3/bin",
   "LD_RUN_PATH=/opt/sqlite3/lib",
   "LD_LIBRARY_PATH=/opt/sqlite3/lib"
 ]

rce/packages/sqlite3/install.sh

@@ -1,7 +1,6 @@
 #!/usr/bin/env bash
 
 cd ~
-apt-get install -y unzip
 curl -LO https://www.sqlite.org/2022/sqlite-autoconf-3390400.tar.gz
 tar -zxf sqlite-autoconf-3390400.tar.gz
 cd sqlite-autoconf-3390400

rce/packages/v/config.toml

@@ -2,7 +2,7 @@ language = "V"
 version = "0.3"
 compiled = false
 extension = "v"
-environment = [ "PATH=/opt/v/0.3:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" ]
+environment = [ "PATH=/opt/v/0.3" ]
 build_command = []
 run_command = [ "/opt/v/0.3/v", "run", "{file}" ]
 test_file = "test.v"

rce/scripts/register-users.cjs

@@ -67,10 +67,10 @@ const GLOBAL_GROUP_ID = 64101;
     for await (const i of ints) {
         const uid = (GLOBAL_GROUP_ID + i).toString();
         const homeDir = `/code/code_executor_${uid}`;
-        const stdout = await execute(`useradd -M --base-dir ${homeDir} --uid ${uid} --gid ${GLOBAL_GROUP_ID.toString()} --shell /bin/bash --home ${homeDir} --comment "Code executor ${uid}" code_executor_${uid}`);
-        console.log(stdout);
+        await execute(`useradd -M --base-dir ${homeDir} --uid ${uid} --gid ${GLOBAL_GROUP_ID.toString()} --shell /bin/bash --home ${homeDir} --comment "Code executor ${uid}" code_executor_${uid}`);
         await fs.mkdir(homeDir, { recursive: true });
-        await fs.chown(homeDir, Number(uid), GLOBAL_GROUP_ID );
+        await execute(`chown -R code_executor_${uid}:code_executors ${homeDir}`);
+        await execute(`chmod 711 ${homeDir}`);
         console.log(`Successfully register user code_executor_${uid}`);
     }
 })();