Merge 673fb8f8dd into a65a9f5549

refactor: unneeded extra check
fix(security): bypass allowed cmds
2025-02-26 13:35:57 +00:00 · 2025-01-01 01:45:29 +01:00 · 2023-11-13 20:58:09 -05:00 · 2023-11-13 20:50:30 -05:00
1 changed files with 3 additions and 0 deletions
--- a/backend/terminal.ts
+++ b/backend/terminal.ts
@ -294,11 +294,14 @@ export class MainTerminal extends InteractiveTerminal {
        // Check if the command is allowed
        const cmdParts = input.split(" ");
        const executable = cmdParts[0].trim();
+        const knownOperators = ["||", "&", ";"];
        log.debug("console", "Executable: " + executable);
        log.debug("console", "Executable length: " + executable.length);

        if (!allowedCommandList.includes(executable)) {
            throw new Error("Command not allowed.");
+        } else if (knownOperators.some(operator => input.includes(operator))) {
+            throw new Error("Control operators are not allowed.");
        }
        super.write(input);
    }
Author	SHA1	Message	Date
zx	f63718b1d4	Merge `673fb8f8dd` into `a65a9f5549`	2025-01-01 01:45:29 +01:00
zx	673fb8f8dd	refactor: unneeded extra check	2023-11-13 20:58:09 -05:00
zx	52ea324129	fix(security): bypass allowed cmds	2023-11-13 20:50:30 -05:00