DoneJS/quickjs-done
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix shell injection bug in std.urlGet (#61)

Browse source
This commit is contained in:
Felix S 2024-02-12 10:20:25 +00:00 committed by GitHub
parent 693449e34e
commit ae6fa8d3d2
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 12 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
quickjs-libc.c
View file

@ -1282,7 +1282,7 @@ static JSValue js_std_file_putByte(JSContext *ctx, JSValueConst this_val,
/* urlGet */
#define URL_GET_PROGRAM "curl -s -i"
#define URL_GET_PROGRAM "curl -s -i --"
#define URL_GET_BUF_SIZE 4096
static int http_get_header_line(FILE *f, char *buf, size_t buf_size,
@ -1355,16 +1355,22 @@ static JSValue js_std_urlGet(JSContext *ctx, JSValueConst this_val,
}
js_std_dbuf_init(ctx, &cmd_buf);
dbuf_printf(&cmd_buf, "%s ''", URL_GET_PROGRAM);
dbuf_printf(&cmd_buf, "%s '", URL_GET_PROGRAM);
len = strlen(url);
for(i = 0; i < len; i++) {
c = url[i];
if (c == '\'' || c == '\\')
switch (c = url[i]) {
case '\'':
dbuf_putstr(&cmd_buf, "'\\''");
break;
case '[': case ']': case '{': case '}': case '\\':
dbuf_putc(&cmd_buf, '\\');
dbuf_putc(&cmd_buf, c);
/* FALLTHROUGH */
default:
dbuf_putc(&cmd_buf, c);
}
}
JS_FreeCString(ctx, url);
dbuf_putstr(&cmd_buf, "''");
dbuf_putstr(&cmd_buf, "'");
dbuf_putc(&cmd_buf, '\0');
if (dbuf_error(&cmd_buf)) {
dbuf_free(&cmd_buf);