Security: Add permission check to ExecuteProcess API

[r3352]

Summary

• ExecuteProcess and ExecuteProcessReturnOutput in Utility.java call Runtime.getRuntime().exec() with no permission check, allowing any connected client to execute arbitrary OS commands on the server
• Adds a new ExecuteProcess permission to Permissions.java and gates both functions behind Permissions.hasPermission() before processing arguments
• Follows the existing permission pattern used by other sensitive API functions (e.g., Security.java, Configuration.java)

Vulnerability Details

CWE-78 (OS Command Injection) / CWE-862 (Missing Authorization)

The ExecuteProcess function at Utility.java:1284 and ExecuteProcessReturnOutput at Utility.java:1371 pass caller-supplied command strings directly to Runtime.exec() without any authorization check. These functions are callable over the network via SageTVConnection.recvAction(), which has no method whitelist. Other sensitive operations in the codebase (e.g., SetDefaultSecurityProfile) correctly check Permissions.hasPermission() before executing — these two functions were missing that check.

Changes

• Permissions.java: Added PERMISSION_EXECUTEPROCESS = "ExecuteProcess" constant and added it to PREDEFINED_PERMISSIONS array
• Utility.java: Added Permissions.hasPermission(PERMISSION_EXECUTEPROCESS, stack.getUIMgr()) check at the start of both ExecuteProcess and ExecuteProcessReturnOutput — returns null if denied

Backward Compatibility

By default, permissions that have not been explicitly set to false return true (see HasPermission documentation). Existing deployments will continue to allow process execution unless an administrator explicitly restricts the ExecuteProcess permission on a security profile. This gives administrators the ability to lock down process execution for untrusted clients while maintaining backward compatibility.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.