Command injection risk in TCP Inlet creation about ockam

[mrinalwadhwa]

@younes-io #7353 and #7354 are great additions so I merged them and then deleted the wrapper in #7360. This way we'll have your improvements if we ever decide to revive the wrapper.

Thank you for all the contributions and the feedback!

[mrinalwadhwa]

@younes-io love that type of review and feedback! Thank you for that.

I'm not certain that we want to maintain the Typescript wrapper around Ockam Command. Are you thinking of using it for something?

The wrapper is a prototype we played around with several months ago for a specific scenario from someone in our community. In that scenario the to argument from TCPInlet.create(...) was coming from a trusted source. In the threat model of that case - someone who could provide a malicious input to TCPInlet.create(...) could also simply run rm -rf .. on the command line.

If we do decide to maintain the wrapper then I agree we should add more sanitization of inputs so someone doesn't accidentally use it for a scenario where the threat model is different.

I'm leaning towards deleting the wrapper prototype instead. Let me know if you have a use case for it in mind. If so, I'd happily reconsider.

[younes-io]

Thanks for considering my feedback =)

My primary concern is ensuring secure code. If the wrapper isn't essential and poses potential security risks, removing it seems reasonable. Oh, and I don't have any use case for the TS impl