catarrh/cdc-file-transfer
1
0
Fork 0
mirror of https://github.com/google/cdc-file-transfer.git synced 2026-09-13 01:10:44 +03:00
Code Issues Packages Projects Releases Wiki Activity

[common] Prevent command execution in ExpandPathVariables (#87)

Browse Source 
Command execution is not something users would expect. Even though
there is no security issue (right now), it's probably better to turn
it off.
This commit is contained in:
Lutz Justen
2023-03-06 15:25:49 +01:00
committed by GitHub
parent a8059e8572
commit c481b6a27f
2 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
common/path.cc
+4 -1
View File
@@ -219,9 +219,12 @@ absl::Status ExpandPathVariables(std::string* path) {
*path = Util::WideToUtf8Str(wchar_expanded);
return absl::OkStatus();
#else
// Exclude command substitution. It.s not what users of this method would
// expect and could lead to security issues.
wordexp_t res;
wordexp(path->c_str(), &res, 0);
wordexp(path->c_str(), &res, WRDE_NOCMD);
if (res.we_wordc > 1) {
wordfree(&res);
return absl::InvalidArgumentError(
"Path expands to multiple results (did you use * etc. ?");
}