From 7eca332200de5beb69ad721024f9314517f61eb9 Mon Sep 17 00:00:00 2001
From: fr4iser <pa.boe90@gmail.com>
Date: Tue, 24 Mar 2026 11:41:03 +0100
Subject: [PATCH] fix: harden local command execution and SNI error handling

Use argument-based child process execution in the shadcn update script to avoid shell interpolation risks and add a nil-safe close fallback in SNI inspection error paths to prevent panics.

Made-with: Cursor
---
 frontend/update-shadcn.cjs | 15 +++++++++++----
 portal/server.go           |  6 +++++-
 2 files changed, 16 insertions(+), 5 deletions(-)

diff --git a/frontend/update-shadcn.cjs b/frontend/update-shadcn.cjs
index 4a51161b..6c222c1f 100644
--- a/frontend/update-shadcn.cjs
+++ b/frontend/update-shadcn.cjs
@@ -2,7 +2,7 @@
 
 const fs = require("fs");
 const path = require("path");
-const { execSync } = require("child_process");
+const { execFileSync } = require("child_process");
 
 /**
  * shadcn 컴포넌트를 자동으로 업데이트하는 스크립트
@@ -69,12 +69,19 @@ function main() {
       try {
         console.log(`🔄 업데이트 중: ${componentName}...`);
 
-        const command = `npx shadcn@latest add -o -y ${componentName}`;
-        execSync(command, {
+        if (!/^[a-z0-9_-]+$/i.test(componentName)) {
+          throw new Error(`invalid component name: ${componentName}`);
+        }
+
+        execFileSync(
+          "npx",
+          ["shadcn@latest", "add", "-o", "-y", componentName],
+          {
           stdio: "pipe",
           encoding: "utf8",
           env: { ...process.env, npm_config_legacy_peer_deps: "true" },
-        });
+          }
+        );
 
         console.log(`✅ ${componentName} 업데이트 완료`);
         successCount++;
diff --git a/portal/server.go b/portal/server.go
index 173e62f1..0fc2dc59 100644
--- a/portal/server.go
+++ b/portal/server.go
@@ -396,7 +396,11 @@ func (s *Server) runSNIListener(ctx context.Context) error {
 func (s *Server) handleSNIConn(ctx context.Context, conn net.Conn) {
 	clientHello, wrappedConn, err := l4.InspectClientHello(conn, s.cfg.ClientHelloTimeout)
 	if err != nil {
-		_ = wrappedConn.Close()
+		if wrappedConn != nil {
+			_ = wrappedConn.Close()
+		} else {
+			_ = conn.Close()
+		}
 		return
 	}