uptime-kuma icon indicating copy to clipboard operation
uptime-kuma copied to clipboard

fix: escaped debugging output

Open CommanderStorm opened this issue 4 months ago • 1 comments

⚠️⚠️⚠️ Since we do not accept all types of pull requests and do not want to waste your time. Please be sure that you have read pull request rules: https://github.com/louislam/uptime-kuma/blob/master/CONTRIBUTING.md#can-i-create-a-pull-request-for-uptime-kuma

Tick the checkbox if you understand [x]:

  • [x] I have read and understand the pull request rules.

Description

Fixes https://github.com/louislam/uptime-kuma/pull/5152#issuecomment-2401033137

Did not think about this because only the user can add these injections => why would anyone inject themselves, but better save than sorry.

I did not use any of the two packages, but rather rolled my own version.

  • execa seems a bit too heavy for our usecase
  • shell-escape is doing something similar as I am doing, but what they are not handling that something like $HOME which adds the home environment variable or the backticks which executes the shell can also escape the shell.

This is the result

curl --verbose --head --request GET \
 --user-agent 'Uptime-Kuma/2.0.0-dev' \
 --location --max-redirs 10 \
 --max-time 48 \
 --url 'https://google.com --not-injected \$Home \`exec\\\` \' <-> \" '

Type of change

Please delete any options that are not relevant.

  • Bug fix (non-breaking change which fixes an issue)

Checklist

  • [x] My code follows the style guidelines of this project
  • [x] I ran ESLint and other linters for modified files
  • [x] I have performed a self-review of my own code and tested it
  • [x] I have commented my code, particularly in hard-to-understand areas (including JSDoc for methods)
  • [x] My changes generates no new warnings

Screenshots (if any)

image

CommanderStorm avatar Oct 09 '24 02:10 CommanderStorm