This PR fixes a path injection security vulnerability in the element-gps module that was flagged by GitHub's CodeQL security scanning (alert #54).

Issue

The read_continuous_gps() function in packages/python-packages/element-gps/main.py was using a relative path when executing the gpspipe subprocess:

process = await asyncio.create_subprocess_exec(
    "./run/current-system/sw/bin/gpspipe",  # Relative path vulnerability
    "-w",
    stdin=asyncio.subprocess.PIPE,
    stdout=asyncio.subprocess.PIPE,
)

This creates a path injection vulnerability where an attacker could potentially manipulate the current working directory to execute a malicious binary instead of the intended gpspipe program.

Solution

Changed the relative path to an absolute path to ensure the correct binary is always executed:

process = await asyncio.create_subprocess_exec(
    "/run/current-system/sw/bin/gpspipe",  # Fixed with absolute path
    "-w",
    stdin=asyncio.subprocess.PIPE,
    stdout=asyncio.subprocess.PIPE,
)

Security Impact

• Prevents path traversal attacks that could lead to arbitrary code execution
• Ensures the correct system binary is always executed regardless of working directory
• Maintains all existing functionality without breaking changes

Verification

• Confirmed this was the only instance of this vulnerability pattern in the codebase
• Python syntax validation passed
• No functional changes to the GPS service behavior
• Minimal surgical fix addressing only the security concern

Fixes #1386.

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.