hanez/fun
1
0
Fork 0
forked from fun/fun
Code Pull requests Activity

Some small injection fixes. (0.42.2)

Browse source
This commit is contained in:
Johannes Findeisen 2026-06-14 22:09:49 +02:00
commit 1b90493a7a
4 changed files with 42 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

18
src/vm/os/proc_system.c
View file

@ -27,6 +27,24 @@ case OP_PROC_SYSTEM: {
push_value(vm, make_int(-1));
break;
}
/* Security hardening: reject commands containing shell metacharacters or control chars
to reduce risk of command injection when using system(3). This preserves simple
command execution like "ls -l" but blocks dangerous constructs like pipes, redirects,
command substitution, etc. */
const char *bad = "&;|$<>`\\\"'()*?[]{}~";
int unsafe = 0;
for (const unsigned char *p = (const unsigned char *)cmd; *p; ++p) {
if (*p < 0x20 || strchr(bad, (int)*p)) { /* control or meta */
unsafe = 1;
break;
}
}
if (unsafe) {
/* refuse to execute potentially unsafe shell command */
push_value(vm, make_int(-1));
free(cmd);
break;
}
int status = system(cmd);
int code = -1;
#ifdef __unix__