diff --git a/docs/security.html b/docs/security.html
index 32f4a5b..092d41e 100644
--- a/docs/security.html
+++ b/docs/security.html
@@ -53,7 +53,7 @@
Affected versions:
< 5.21.07 (version 4 is not affected)
Date: 2023-09-19
- CVE indentifier -
+ CVE indentifier CVE-2023-42810
Impact
diff --git a/lib/docker.js b/lib/docker.js
index c7b4efc..1f1184f 100644
--- a/lib/docker.js
+++ b/lib/docker.js
@@ -462,7 +462,8 @@ function dockerContainerStats(containerIDs, callback) {
if (containerIDsSanitized !== '*') {
containerIDsSanitized = '';
const s = (util.isPrototypePolluted() ? '' : util.sanitizeShellString(containerIDs, true)).trim();
- for (let i = 0; i <= util.mathMin(s.length, 2000); i++) {
+ const l = util.mathMin(s.length, 2000);
+ for (let i = 0; i <= l; i++) {
if (s[i] !== undefined) {
s[i].__proto__.toLowerCase = util.stringToLower;
const sl = s[i].toLowerCase();
diff --git a/lib/internet.js b/lib/internet.js
index 84ac517..a9a05cf 100644
--- a/lib/internet.js
+++ b/lib/internet.js
@@ -45,7 +45,8 @@ function inetChecksite(url, callback) {
}
let urlSanitized = '';
const s = util.sanitizeShellString(url, true);
- for (let i = 0; i <= util.mathMin(s.length, 2000); i++) {
+ const l = util.mathMin(s.length, 2000);
+ for (let i = 0; i <= l; i++) {
if (s[i] !== undefined) {
s[i].__proto__.toLowerCase = util.stringToLower;
const sl = s[i].toLowerCase();
@@ -143,7 +144,8 @@ function inetLatency(host, callback) {
}
let hostSanitized = '';
const s = (util.isPrototypePolluted() ? '8.8.8.8' : util.sanitizeShellString(host, true)).trim();
- for (let i = 0; i <= util.mathMin(s.length, 2000); i++) {
+ const l = util.mathMin(s.length, 2000);
+ for (let i = 0; i <= l; i++) {
if (!(s[i] === undefined)) {
s[i].__proto__.toLowerCase = util.stringToLower;
const sl = s[i].toLowerCase();
diff --git a/lib/network.js b/lib/network.js
index 6f0253d..61d10cd 100644
--- a/lib/network.js
+++ b/lib/network.js
@@ -745,7 +745,8 @@ function networkInterfaces(callback, rescan, defaultString) {
let ifaceSanitized = '';
const s = util.isPrototypePolluted() ? '---' : util.sanitizeShellString(nic.iface);
- for (let i = 0; i <= util.mathMin(s.length, 2000); i++) {
+ const l = util.mathMin(s.length, 2000);
+ for (let i = 0; i <= l; i++) {
if (s[i] !== undefined) {
ifaceSanitized = ifaceSanitized + s[i];
}
@@ -840,7 +841,8 @@ function networkInterfaces(callback, rescan, defaultString) {
let iface = dev.split(':')[0].trim().toLowerCase();
let ifaceSanitized = '';
const s = util.isPrototypePolluted() ? '---' : util.sanitizeShellString(iface);
- for (let i = 0; i <= util.mathMin(s.length, 2000); i++) {
+ const l = util.mathMin(s.length, 2000);
+ for (let i = 0; i <= l; i++) {
if (s[i] !== undefined) {
ifaceSanitized = ifaceSanitized + s[i];
}
@@ -973,7 +975,8 @@ function networkInterfaces(callback, rescan, defaultString) {
let ifaceSanitized = '';
const s = util.isPrototypePolluted() ? '---' : util.sanitizeShellString(dev);
- for (let i = 0; i <= util.mathMin(s.length, 2000); i++) {
+ const l = util.mathMin(s.length, 2000);
+ for (let i = 0; i <= l; i++) {
if (s[i] !== undefined) {
ifaceSanitized = ifaceSanitized + s[i];
}
@@ -1221,7 +1224,8 @@ function networkStatsSingle(iface) {
process.nextTick(() => {
let ifaceSanitized = '';
const s = util.isPrototypePolluted() ? '---' : util.sanitizeShellString(iface);
- for (let i = 0; i <= util.mathMin(s.length, 2000); i++) {
+ const l = util.mathMin(s.length, 2000);
+ for (let i = 0; i <= l; i++) {
if (s[i] !== undefined) {
ifaceSanitized = ifaceSanitized + s[i];
}
diff --git a/lib/processes.js b/lib/processes.js
index 68f2255..8314bc9 100644
--- a/lib/processes.js
+++ b/lib/processes.js
@@ -131,7 +131,8 @@ function services(srv, callback) {
srvString.__proto__.trim = util.stringTrim;
const s = util.sanitizeShellString(srv);
- for (let i = 0; i <= util.mathMin(s.length, 2000); i++) {
+ const l = util.mathMin(s.length, 2000);
+ for (let i = 0; i <= l; i++) {
if (s[i] !== undefined) {
srvString = srvString + s[i];
}
@@ -986,7 +987,9 @@ function processLoad(proc, callback) {
processesString.__proto__.trim = util.stringTrim;
const s = util.sanitizeShellString(proc);
- for (let i = 0; i <= util.mathMin(s.length, 2000); i++) {
+ const l = util.mathMin(s.length, 2000);
+
+ for (let i = 0; i <= l; i++) {
if (s[i] !== undefined) {
processesString = processesString + s[i];
}
diff --git a/lib/util.js b/lib/util.js
index de1255d..f1b8a48 100644
--- a/lib/util.js
+++ b/lib/util.js
@@ -682,7 +682,8 @@ function sanitizeShellString(str, strict) {
if (typeof strict === 'undefined') { strict = false; }
const s = str || '';
let result = '';
- for (let i = 0; i <= mathMin(s.length, 2000); i++) {
+ const l = mathMin(s.length, 2000);
+ for (let i = 0; i <= l; i++) {
if (!(s[i] === undefined ||
s[i] === '>' ||
s[i] === '<' ||
diff --git a/lib/wifi.js b/lib/wifi.js
index 40626d4..8b35de8 100644
--- a/lib/wifi.js
+++ b/lib/wifi.js
@@ -403,7 +403,9 @@ function wifiNetworks(callback) {
if (iface) {
let ifaceSanitized = '';
const s = util.isPrototypePolluted() ? '---' : util.sanitizeShellString(iface, true);
- for (let i = 0; i <= util.mathMin(s.length, 2000); i++) {
+ const l = util.mathMin(s.length, 2000);
+
+ for (let i = 0; i <= l; i++) {
if (s[i] !== undefined) {
ifaceSanitized = ifaceSanitized + s[i];
}
@@ -539,7 +541,9 @@ function wifiConnections(callback) {
ifaces.forEach(ifaceDetail => {
let ifaceSanitized = '';
const s = util.isPrototypePolluted() ? '---' : util.sanitizeShellString(ifaceDetail.iface, true);
- for (let i = 0; i <= util.mathMin(s.length, 2000); i++) {
+ const ll = util.mathMin(s.length, 2000);
+
+ for (let i = 0; i <= ll; i++) {
if (s[i] !== undefined) {
ifaceSanitized = ifaceSanitized + s[i];
}
@@ -551,7 +555,8 @@ function wifiConnections(callback) {
const network = networkList.filter(nw => nw.ssid === ssid);
let ssidSanitized = '';
const t = util.isPrototypePolluted() ? '---' : util.sanitizeShellString(ssid, true);
- for (let i = 0; i <= util.mathMin(t.length, 2000); i++) {
+ const l = util.mathMin(t.length, 2000);
+ for (let i = 0; i <= l; i++) {
if (t[i] !== undefined) {
ssidSanitized = ssidSanitized + t[i];
}