diff --git a/CHANGELOG.md b/CHANGELOG.md index 0e95ea8..dfc3eb0 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -30,6 +30,7 @@ For major (breaking) changes - version 3 and 2 see end of page. | Version | Date | Comment | | -------------- | -------------- | -------- | +| 4.27.11 | 2020-10-26 | `inetChecksite()` fixed vulnerability: command injection | | 4.27.10 | 2020-10-16 | `dockerContainers()` resolved hanging issue | | 4.27.9 | 2020-10-13 | `networkInterfaces()` loopback internal detection (windows) | | 4.27.8 | 2020-10-08 | windows codepages partial fix | diff --git a/docs/history.html b/docs/history.html index 05c9067..da01d35 100644 --- a/docs/history.html +++ b/docs/history.html @@ -83,6 +83,11 @@ + + 4.27.11 + 2020-10-26 + inetChecksite() fixed vulnerability: command injection + 4.27.10 2020-10-16 diff --git a/docs/index.html b/docs/index.html index 1a843ac..ba2af03 100644 --- a/docs/index.html +++ b/docs/index.html @@ -168,7 +168,7 @@
systeminformation
-
Current Version: 4.27.10
+
Current Version: 4.27.11
diff --git a/lib/internet.js b/lib/internet.js index 414ef75..ac81e36 100644 --- a/lib/internet.js +++ b/lib/internet.js @@ -34,7 +34,13 @@ function inetChecksite(url, callback) { return new Promise((resolve) => { process.nextTick(() => { - const urlSanitized = util.sanitizeShellString(url).toLowerCase(); + let urlSanitized = util.sanitizeShellString(url).toLowerCase(); + urlSanitized = urlSanitized.replace(/ /g, ''); + urlSanitized = urlSanitized.replace(/\$/g, ''); + urlSanitized = urlSanitized.replace(/\(/g, ''); + urlSanitized = urlSanitized.replace(/\)/g, ''); + urlSanitized = urlSanitized.replace(/{/g, ''); + urlSanitized = urlSanitized.replace(/}/g, ''); let result = { url: urlSanitized, ok: false,