mirror of
https://github.com/danielmiessler/fabric.git
synced 2026-09-10 07:36:44 -04:00
3eba7a51d4
The extension executor runs commands via 'sh -c' with user-controlled
values interpolated into the command string without escaping. A value
containing shell metacharacters (;, |, $(), backticks) is executed by
the shell, enabling command injection.
User input flows from content processed through a pattern into the
extension system via the InputSentinel, then into formatCommand which
interpolates it into the cmd_template, then into exec.Command('sh', '-c').
No escaping is applied at any point.
Fix: wrap all user-controlled values (value, numbered pipe-split values)
in single quotes with embedded-single-quote escaping before interpolation.
This ensures sh -c treats them as literal arguments, not shell syntax.
The existing tests pass unchanged because the inner sh strips the single
quotes, so the executed command receives the same argument values.
Regression test added: ShellInjectionBlocked verifies that input
'hello; touch /marker' does not create the marker file.
Signed-off-by: John Kearney <johndanielkearney@gmail.com>
|
||
|---|---|---|
| .. | ||
| chat | ||
| cli | ||
| core | ||
| domain | ||
| i18n | ||
| log | ||
| plugins | ||
| server | ||
| tools | ||
| util | ||