fix: Fail fast when VNC password file creation fails instead of starting without auth

[cubic-dev-ai]

Summary

• Fixed security vulnerability in expo-android start script that could expose unauthenticated VNC server
• Script now exits with error if VNC password file cannot be created, instead of falling back to no authentication

Changes

• Added proper error handling after VNC password file creation attempt
• Added mkdir -p to ensure parent directory exists before password file creation
• Added secondary verification check before starting VNC server
• Removed dangerous fallback that started x11vnc without -rfbauth flag

Security Impact

Previously, if the password file creation failed (e.g., due to permissions issues), the script would log a warning and start VNC without authentication, exposing the display to anyone who could reach port 5900.

Now, the script follows a "fail closed" approach - if authentication cannot be properly configured, the service refuses to start.

🤖 Generated with Claude Code

Co-Authored-By: Claude noreply@anthropic.com

---

Summary by cubic

Prevents unauthenticated VNC by failing fast if the password file can’t be created in the expo-android start script. The script now verifies the file and exits instead of starting without auth.

• Bug Fixes
  • Ensure /home/user exists before creating the password file.
  • Exit with an error if password file creation or verification fails.
  • Always start x11vnc with -rfbauth; removed the unsafe no-auth fallback.

^{Written for commit 68dc8be. Summary will update on new commits.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
zapdev	Ready	Preview, Comment	Jan 18, 2026 5:44am

[codecapyai]

CodeCapy Review ₍ᐢ•(ܫ)•ᐢ₎

• PR: fix: Fail fast when VNC password file creation fails instead of starting without auth #214
• Commit: 68dc8be

Codebase Summary

ZapDev is an AI-powered development platform that allows users to create web applications via a chat-driven interface in real-time sandboxes. It features code generation with AI agents, real-time updates, and a sophisticated UI for file exploration, messaging, and project management, built with Next.js, React, and Tailwind CSS.

PR Changes

This pull request changes the expo-android start script to enforce security for the VNC server. The script now attempts to create the VNC password file with proper directory creation (using mkdir -p) and explicitly exits with an error if the creation fails or if the file is missing. Previously, the script would fall back to starting the VNC server without authentication. The change introduces a 'fail closed' approach to prevent unauthorized access.

Setup Instructions

1. Install pnpm globally: sudo npm install -g pnpm
2. Navigate to the repository directory.
3. Install dependencies by running: pnpm install
4. Start the development server using: pnpm dev
5. Open your browser and navigate to http://localhost:3000 (if applicable) to access the web application.

Generated Test Cases

1: Successful VNC Password File Creation and VNC Server Start ❗️❗️❗️

Description: Tests that when the environment allows for creation of the VNC password file, the script logs the correct messages and starts the VNC server with authentication.

Prerequisites:

• Ensure that the directory /home/user is writable (or simulate a normal environment).
• No pre-existing /home/user/.vnc_passwd file, or if it exists, its content is valid for the test scenario.

Steps:

1. Open a terminal session and navigate to the repository.
2. Set up the environment so that /home/user is writable.
3. Run the expo-android start script (e.g., sh sandbox-templates/expo-android/start_android.sh).
4. Observe the terminal output.

Expected Result: The script logs '[INFO] Creating VNC password file...', successfully creates the VNC password file, verifies its existence, and then logs '[INFO] Starting VNC server on port 5900...'. The VNC server is started using the x11vnc command with the -rfbauth flag.

2: Fail Fast When VNC Password File Creation Fails Due to Directory Permission Issues ❗️❗️❗️

Description: Tests that if the script cannot create the VNC password file because of permission issues (or a non-writable /home/user), it logs an error and exits without starting the VNC server.

Prerequisites:

• Ensure that /home/user is non-writable (simulate by changing the permissions of /home/user to read-only or by using a test directory mapped to /home/user with no write access).

Steps:

1. Modify permissions of /home/user so that it is non-writable.
2. Open a terminal session and run the expo-android start script.
3. Observe the terminal output.

Expected Result: The script logs '[INFO] Creating VNC password file...' followed by '[ERROR] Failed to create VNC password file. Exiting to prevent unauthenticated VNC access.' and then exits, ensuring that the VNC server is not started.

3: Pre-existing VNC Password File Skips Creation and Starts VNC Server with Authentication ❗️❗️

Description: Tests that when a valid VNC password file pre-exists, the script does not attempt to recreate it and proceeds to start the VNC server with the existing file for authentication.

Prerequisites:

• Pre-create a valid VNC password file at /home/user/.vnc_passwd with appropriate content.
• Ensure that /home/user is writable.

Steps:

1. Manually create the file /home/user/.vnc_passwd with sample content (e.g., using echo 'vncpasswd' > /home/user/.vnc_passwd).
2. Open a terminal session and run the expo-android start script.
3. Observe the terminal output.

Expected Result: The script detects the pre-existing VNC password file (skipping the creation block) and confirms its existence. It then logs '[INFO] Starting VNC server on port 5900...' and starts the VNC server with the -rfbauth option using the existing file.

4: Error Handling for Missing VNC Password File After Creation Attempt ❗️❗️

Description: Ensures that if, for any unexpected reason, the VNC password file is missing immediately after the creation attempt, the script logs an error and exits without starting the VNC server.

Prerequisites:

• Simulate an environment or modify the script temporarily to delete the password file right after creation (this can be done by adding a command in a test wrapper).

Steps:

1. Modify the test script to delete /home/user/.vnc_passwd immediately after it is created.
2. Run the start_android.sh script in a terminal.
3. Watch the terminal output.

Expected Result: The script logs an error '[ERROR] VNC password file not found at /home/user/.vnc_passwd. Refusing to start VNC without authentication.' and exits without starting the VNC server.

Raw Changes Analyzed

File: sandbox-templates/expo-android/start_android.sh
Changes:
@@ -15,17 +15,24 @@ fluxbox &
 # Generate VNC password if not exists
 VNC_PASSWD_FILE="/home/user/.vnc_passwd"
 if [ ! -f "$VNC_PASSWD_FILE" ]; then
-    echo "vncpasswd" | head -1 > "$VNC_PASSWD_FILE" 2>/dev/null || true
+    echo "[INFO] Creating VNC password file..."
+    mkdir -p /home/user
+    echo "vncpasswd" | head -1 > "$VNC_PASSWD_FILE" 2>/dev/null
+    if [ $? -ne 0 ] || [ ! -f "$VNC_PASSWD_FILE" ]; then
+        echo "[ERROR] Failed to create VNC password file. Exiting to prevent unauthenticated VNC access."
+        exit 1
+    fi
+fi
+
+# Verify VNC password file exists before starting server
+if [ ! -f "$VNC_PASSWD_FILE" ]; then
+    echo "[ERROR] VNC password file not found at $VNC_PASSWD_FILE. Refusing to start VNC without authentication."
+    exit 1
 fi
 
 # Start VNC server with password authentication
 echo "[INFO] Starting VNC server on port 5900..."
-if [ -f "$VNC_PASSWD_FILE" ]; then
-    x11vnc -display :99 -forever -shared -rfbport 5900 -rfbauth "$VNC_PASSWD_FILE" &
-else
-    echo "[WARN] VNC password file not found, starting without authentication"
-    x11vnc -display :99 -forever -shared -rfbport 5900 &
-fi
+x11vnc -display :99 -forever -shared -rfbport 5900 -rfbauth "$VNC_PASSWD_FILE" &
 
 # Wait for display services
 sleep 2

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[cubic-dev-ai]

No issues found across 1 file

[codecapyai]

🚀 Launching Scrapybara desktop...

[codecapyai]

❌ Something went wrong:

status_code: 500, body: {'detail': 'Error creating instance: HTTPSConnectionPool(host=\'dd71ce9e4c14175cfb2d4b4d613159f4.sk1.us-west-1.eks.amazonaws.com\', port=443): Max retries exceeded with url: /api/v1/namespaces/scrapybara-instances/services (Caused by NameResolutionError("<urllib3.connection.HTTPSConnection object at 0x7f0028d34410>: Failed to resolve \'dd71ce9e4c14175cfb2d4b4d613159f4.sk1.us-west-1.eks.amazonaws.com\' ([Errno -2] Name or service not known)"))'}

[stormkit-io]

Deployment failed

This pull request failed while building automatically on Stormkit. You can preview the logs using the following link.
https://app.stormkit.io/app/16264/deployments/86461