Command injection via additional_args across all /api/tools/* endpoints (follow-up to #263)

Summary

Follow-up to #263/#264. Every /api/tools/* endpoint that accepts an additional_args parameter (97 occurrences in hexstrike_server.py) appends it to the shell=True command string with no sanitization at all. This is independent of the target/url/ports/wordlist fields: even an endpoint where those are properly quoted is still exploitable through additional_args alone, including the nmap and gobuster endpoints #264 already patches (that fix quotes target/url/ports/wordlist, not additional_args).

Affected: current master (v6.0), commit d689933ff579d839c676c82b231f8e98326c5f04.

Details

/api/tools/nmap (post-#264 fix, for illustration):

command = f"nmap {scan_type}"
if ports:
    command += f" -p {safe_shell_arg(ports)}"
if additional_args:
    command += f" {additional_args}"      # <- unquoted
command += f" {safe_shell_arg(target)}"

additional_args is meant to carry multiple space-separated CLI flags (e.g. "-T4 -Pn"), so it cannot simply be wrapped whole in shlex.quote() (that would make the shell see it as one argument, breaking every legitimate multi-flag use). It needs per-token quoting: split on shell-word boundaries, then quote each token individually.

POC

(available upon request)

Impact

A caller who cannot inject via target/url (because those are validated or the maintainer applies #264) can still inject via additional_args on any of the 97 endpoints that accept it, unauthenticated, given the server's 0.0.0.0 bind with no authentication anywhere in the code (per #263).