github/myvesta
1
0
Fork 0
mirror of https://github.com/myvesta/vesta synced 2025-08-19 21:04:07 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix for Sed Injection Vulnerability

Browse source
This commit is contained in:
myvesta 2022-06-04 19:06:23 +02:00 • committed by GitHub
commit 0f86941e8e
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 18 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

1
bin/v-change-sys-config-value
View file

@ -28,6 +28,7 @@ PATH="$PATH:/usr/local/sbin:/sbin:/usr/sbin:/root/bin"
check_args '2' "$#" 'KEY VALUE' check_args '2' "$#" 'KEY VALUE'
is_format_valid 'key' is_format_valid 'key'
format_no_quotes "$value" 'value'
#----------------------------------------------------------# #----------------------------------------------------------#
# Action # # Action #

17
func/main.sh
View file

@ -838,6 +838,22 @@ is_format_valid_shell() {
exit $E_INVALID exit $E_INVALID
fi fi
} }
format_no_quotes() {
exclude="['|\"]"
if [[ "$1" =~ $exclude ]]; then
check_result "$E_INVALID" "Invalid $2 contains qoutes (\" or ') :: $1"
fi
is_no_new_line_format "$1"
}
is_no_new_line_format() {
test=$(echo "$1" | head -n1 );
if [[ "$test" != "$1" ]]; then
check_result "$E_INVALID" "invalid value :: $1"
fi
}
# Format validation controller # Format validation controller
is_format_valid() { is_format_valid() {
for arg_name in $*; do for arg_name in $*; do
@ -846,6 +862,7 @@ is_format_valid() {
case $arg_name in case $arg_name in
account) is_user_format_valid "$arg" "$arg_name";; account) is_user_format_valid "$arg" "$arg_name";;
action) is_fw_action_format_valid "$arg";; action) is_fw_action_format_valid "$arg";;
alias) is_alias_format_valid "$arg" ;;
aliases) is_alias_format_valid "$arg" ;; aliases) is_alias_format_valid "$arg" ;;
antispam) is_boolean_format_valid "$arg" 'antispam' ;; antispam) is_boolean_format_valid "$arg" 'antispam' ;;
antivirus) is_boolean_format_valid "$arg" 'antivirus' ;; antivirus) is_boolean_format_valid "$arg" 'antivirus' ;;