LOC-6805: allowlist option keys forwarded to the BrowserStackLocal binary

addArgs() prefixed ANY unrecognised key in the caller-supplied options
object with '--' and pushed it, with its value, onto the daemon argv. Any
caller — or upstream code merging untrusted input into options — could
inject arbitrary flags into the native binary (CWE-88).

Only documented BrowserStackLocal modifiers are forwarded now. The
allowlist mirrors the binary's own CLI definition (COMMAND_CONFIGURATION
in browserStackTunnel), long names and aliases, so every documented
modifier without an explicit switch case — localProxyHost/Port/User/Pass,
pac-file, custom-repeater, bs-host — keeps working.

Also refused:
- daemon / log-file / source, which getBinaryArgs() sets itself, so a
  caller cannot append a conflicting second copy (e.g. '--daemon stop'
  after our '--daemon start')
- a value beginning with '-'. The binary's parser does not consume such a
  value, it reads it as another flag, so a legitimate key could still
  smuggle one in. These values are already mis-parsed today, so this is
  not a regression.
- onlyCommand, a wrapper-internal key, no longer leaks into the argv.

addArgs returns a LocalError, delivered through the existing paths:
callback(err) for start(), returned for startSync().

Closes the entry step of chain C-008. LOC-6790 (binarypath traversal) and
LOC-6777 (no binary integrity check) are unaffected and remain open — the
chain description's claim that this gates binarypath is inaccurate, that
value is an explicit switch case.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: 07souravkunda

README.md

@@ -40,6 +40,8 @@ bs_local.start(bs_local_args, function() {
 
 Apart from the key, all other BrowserStack Local modifiers are optional. For the full list of modifiers, refer [BrowserStack Local modifiers](https://www.browserstack.com/local-testing#modifiers). For examples, refer below -
 
+Only documented modifiers are forwarded to the binary. An unrecognised option key, an option the wrapper sets itself (`daemon`, `log-file`), or a value beginning with `-` is refused with an error rather than passed through to the `BrowserStackLocal` argv — otherwise any code that merges untrusted input into the options object could inject arbitrary flags into the binary.
+
 #### Verbose Logging
 To enable verbose logging -
 ```js

lib/Local.js

@@ -9,6 +9,60 @@ var childProcess = require('child_process'),
   version = require('../package.json').version,
   treeKill = require('tree-kill');
 
+// Option keys this wrapper is allowed to forward verbatim to the
+// BrowserStackLocal daemon. Mirrors the binary's own CLI definition
+// (COMMAND_CONFIGURATION in browserStackTunnel, extensions/node/config/constants.js)
+// — long names and their aliases — so every documented modifier keeps working
+// while an unrecognised key can no longer reach the daemon argv.
+var PASSTHROUGH_OPTIONS = [
+  'key', 'folder', 'help', 'version', 'force', 'only',
+  'forcelocal', 'force-local',
+  'verbose',
+  'onlyAutomate', 'only-automate',
+  'proxyHost', 'proxy-host',
+  'proxyPort', 'proxy-port',
+  'proxyUser', 'proxy-user',
+  'proxyPass', 'proxy-pass',
+  'localIdentifier', 'local-identifier',
+  'forceproxy', 'force-proxy',
+  'region',
+  'localProxyHost', 'local-proxy-host',
+  'localProxyPort', 'local-proxy-port',
+  'localProxyUser', 'local-proxy-user',
+  'localProxyPass', 'local-proxy-pass',
+  'enableLoggingForAPI', 'enable-logging-for-api',
+  'logFile',
+  'pacFile', 'pac-file',
+  'parallelRuns', 'parallel-runs',
+  'disableProxyDiscovery', 'disable-proxy-discovery',
+  'enableUTCLogging', 'enable-utc-logging',
+  'no-container',
+  'include-hosts', 'exclude-hosts',
+  'bsHost', 'bs-host',
+  'debug-utility', 'debug-url',
+  'customRepeater', 'custom-repeater',
+  'enterprise',
+  'use-system-installed-ca', 'use-ca-certificate',
+  'https-ports',
+  'ntlm-username', 'ntlm-password', 'ntlm-domain', 'ntlm-workstation',
+  'connect-timeout',
+  'public-interface-services',
+  'disableDashboard', 'disable-dashboard',
+  'config-file',
+  'client-protocol',
+  'identifier',
+  'trusted-hosts'
+];
+
+// Flags getBinaryArgs() always puts on the argv itself. Accepting them from
+// the options object too would let a caller append a second, conflicting copy
+// — e.g. '--daemon stop' after our '--daemon start'. ('logFile' has its own
+// supported option; only the raw binary alias is reserved.)
+var RESERVED_OPTIONS = ['daemon', 'log-file', 'source'];
+
+// Keys consumed by this wrapper and never meant for the binary.
+var INTERNAL_OPTIONS = ['onlyCommand'];
+
 function Local(){
   this.sanitizePath = function(rawPath) {
     var doubleQuoteIfRequired = this.windows && !rawPath.match(/"[^"]+"/) ? '"' : '';
@@ -30,7 +84,9 @@ function Local(){
   this.startSync = function(options) {
     this.userArgs = [];
     var that = this;
-    this.addArgs(options);
+    const argsError = this.addArgs(options);
+    if(argsError)
+      return argsError;
 
     if(typeof options['onlyCommand'] !== 'undefined')
       return;
@@ -83,7 +139,9 @@ function Local(){
   this.start = function(options, callback){
     this.userArgs = [];
     var that = this;
-    this.addArgs(options);
+    const argsError = this.addArgs(options);
+    if(argsError)
+      return callback(argsError);
 
     if(typeof options['onlyCommand'] !== 'undefined')
       return callback();
@@ -245,18 +303,46 @@ function Local(){
           this.binaryPath = value;
         break;
 
-      default:
-        if(value.toString().toLowerCase() == 'true'){
-          this.userArgs.push('--' + key);
-        } else {
-          this.userArgs.push('--' + key);
-          this.userArgs.push(value);
-        }
+      default: {
+        var error = this.addUserArg(key, value);
+        if(error)
+          return error;
         break;
       }
+      }
     }
   };
 
+  // Forwards one caller-supplied option to the daemon argv, or returns a
+  // LocalError describing why it was refused. Only documented modifiers get
+  // through: an unknown key used to be prefixed with '--' and pushed blindly,
+  // which let any caller inject arbitrary flags into the native binary.
+  this.addUserArg = function(key, value){
+    if(INTERNAL_OPTIONS.indexOf(key) !== -1)
+      return;
+
+    if(RESERVED_OPTIONS.indexOf(key) !== -1)
+      return new LocalError('Option \'' + key + '\' is set by browserstack-local itself and cannot be passed in');
+
+    if(PASSTHROUGH_OPTIONS.indexOf(key) === -1)
+      return new LocalError('Unknown option \'' + key + '\'. Only documented BrowserStack Local modifiers are forwarded to the binary, see https://www.browserstack.com/local-testing#modifiers');
+
+    var stringValue = value === undefined || value === null ? '' : value.toString();
+
+    if(stringValue.toLowerCase() == 'true'){
+      this.userArgs.push('--' + key);
+      return;
+    }
+
+    // The binary's argv parser will not consume a value that begins with '-';
+    // it reads it as another flag instead. Refuse rather than smuggle one in.
+    if(stringValue.charAt(0) === '-')
+      return new LocalError('Invalid value for option \'' + key + '\': values starting with \'-\' are not allowed');
+
+    this.userArgs.push('--' + key);
+    this.userArgs.push(value);
+  };
+
   this.getBinaryPath = function(callback, bsHost){
     if(typeof(this.binaryPath) == 'undefined'){
       this.binary = new LocalBinary();

test/local.js

@@ -124,20 +124,80 @@ describe('Local', function () {
     });
   });
 
-  it('should enable custom boolean args', function (done) {
-    bsLocal.start({ 'key': process.env.BROWSERSTACK_ACCESS_KEY, onlyCommand: true, 'boolArg1': true, 'boolArg2': true }, function(){
-      expect(bsLocal.getBinaryArgs().indexOf('--boolArg1')).to.not.equal(-1);
-      expect(bsLocal.getBinaryArgs().indexOf('--boolArg2')).to.not.equal(-1);
+  // LOC-6805 / LOC-6783 (F-007, CWE-88): addArgs used to prefix ANY unknown
+  // option key with '--' and push it onto the daemon argv, letting a caller
+  // — or upstream code merging untrusted input into `options` — inject
+  // arbitrary flags into the native binary. Only documented BrowserStackLocal
+  // modifiers may be forwarded now.
+
+  it('should reject unknown boolean args', function (done) {
+    bsLocal.start({ 'key': process.env.BROWSERSTACK_ACCESS_KEY, onlyCommand: true, 'boolArg1': true, 'boolArg2': true }, function(error){
+      expect(error).to.be.an(Error);
+      expect(error.toString()).to.contain('Unknown option \'boolArg1\'');
+      expect(bsLocal.getBinaryArgs().indexOf('--boolArg1')).to.equal(-1);
+      expect(bsLocal.getBinaryArgs().indexOf('--boolArg2')).to.equal(-1);
       done();
     });
   });
 
-  it('should enable custom keyval args', function (done) {
-    bsLocal.start({ 'key': process.env.BROWSERSTACK_ACCESS_KEY, onlyCommand: true, 'customKey1': 'custom value1', 'customKey2': 'custom value2' }, function(){
-      expect(bsLocal.getBinaryArgs().indexOf('--customKey1')).to.not.equal(-1);
-      expect(bsLocal.getBinaryArgs().indexOf('custom value1')).to.not.equal(-1);
-      expect(bsLocal.getBinaryArgs().indexOf('--customKey2')).to.not.equal(-1);
-      expect(bsLocal.getBinaryArgs().indexOf('custom value2')).to.not.equal(-1);
+  it('should reject unknown keyval args', function (done) {
+    bsLocal.start({ 'key': process.env.BROWSERSTACK_ACCESS_KEY, onlyCommand: true, 'customKey1': 'custom value1', 'customKey2': 'custom value2' }, function(error){
+      expect(error).to.be.an(Error);
+      expect(error.toString()).to.contain('Unknown option \'customKey1\'');
+      expect(bsLocal.getBinaryArgs().indexOf('--customKey1')).to.equal(-1);
+      expect(bsLocal.getBinaryArgs().indexOf('custom value1')).to.equal(-1);
+      done();
+    });
+  });
+
+  it('should reject the reported flag-injection payload', function (done) {
+    bsLocal.start({ 'key': process.env.BROWSERSTACK_ACCESS_KEY, onlyCommand: true, 'config': '/tmp/attacker.conf', 'daemon': 'stop' }, function(error){
+      expect(error).to.be.an(Error);
+      const args = bsLocal.getBinaryArgs();
+      expect(args.indexOf('--config')).to.equal(-1);
+      expect(args.indexOf('/tmp/attacker.conf')).to.equal(-1);
+      // the wrapper's own '--daemon start' must be the only daemon flag
+      expect(args.indexOf('stop')).to.equal(-1);
+      done();
+    });
+  });
+
+  it('should reject options the wrapper sets itself', function (done) {
+    bsLocal.start({ 'key': process.env.BROWSERSTACK_ACCESS_KEY, onlyCommand: true, 'log-file': '/tmp/attacker-owned' }, function(error){
+      expect(error).to.be.an(Error);
+      expect(error.toString()).to.contain('set by browserstack-local itself');
+      expect(bsLocal.getBinaryArgs().indexOf('/tmp/attacker-owned')).to.equal(-1);
+      done();
+    });
+  });
+
+  it('should reject a value that would be parsed as another flag', function (done) {
+    // bs-minimist does not consume a value beginning with '-'; it reads it as
+    // a separate flag, so a legitimate key can still smuggle one in.
+    bsLocal.start({ 'key': process.env.BROWSERSTACK_ACCESS_KEY, onlyCommand: true, 'region': '--pac-file' }, function(error){
+      expect(error).to.be.an(Error);
+      expect(error.toString()).to.contain('values starting with \'-\' are not allowed');
+      expect(bsLocal.getBinaryArgs().indexOf('--pac-file')).to.equal(-1);
+      done();
+    });
+  });
+
+  it('should not forward wrapper-internal keys to the binary', function (done) {
+    bsLocal.start({ 'key': process.env.BROWSERSTACK_ACCESS_KEY, onlyCommand: true }, function(error){
+      expect(error).to.equal(undefined);
+      expect(bsLocal.getBinaryArgs().indexOf('--onlyCommand')).to.equal(-1);
+      done();
+    });
+  });
+
+  it('should still forward documented modifiers that have no explicit case', function (done) {
+    bsLocal.start({ 'key': process.env.BROWSERSTACK_ACCESS_KEY, onlyCommand: true, 'localProxyHost': '127.0.0.1', 'pac-file': '/tmp/proxy.pac' }, function(error){
+      expect(error).to.equal(undefined);
+      const args = bsLocal.getBinaryArgs();
+      expect(args.indexOf('--localProxyHost')).to.not.equal(-1);
+      expect(args.indexOf('127.0.0.1')).to.not.equal(-1);
+      expect(args.indexOf('--pac-file')).to.not.equal(-1);
+      expect(args.indexOf('/tmp/proxy.pac')).to.not.equal(-1);
       done();
     });
   });