mike/systeminformation
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

inetChecksite() fixed vulnerability: command injection

Browse Source
This commit is contained in:
Sebastian Hildebrandt
2020-10-26 10:53:59 +01:00
parent 443d85e3b8
commit 931fecaec2
4 changed files with 14 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/internet.js
+7 -1
View File
@@ -34,7 +34,13 @@ function inetChecksite(url, callback) {
return new Promise((resolve) => {
process.nextTick(() => {
const urlSanitized = util.sanitizeShellString(url).toLowerCase();
let urlSanitized = util.sanitizeShellString(url).toLowerCase();
urlSanitized = urlSanitized.replace(/ /g, '');
urlSanitized = urlSanitized.replace(/\$/g, '');
urlSanitized = urlSanitized.replace(/\(/g, '');
urlSanitized = urlSanitized.replace(/\)/g, '');
urlSanitized = urlSanitized.replace(/{/g, '');
urlSanitized = urlSanitized.replace(/}/g, '');
let result = {
url: urlSanitized,
ok: false,