uptime-kuma
uptime-kuma copied to clipboard
fix: escaped debugging output
⚠️⚠️⚠️ Since we do not accept all types of pull requests and do not want to waste your time. Please be sure that you have read pull request rules: https://github.com/louislam/uptime-kuma/blob/master/CONTRIBUTING.md#can-i-create-a-pull-request-for-uptime-kuma
Tick the checkbox if you understand [x]:
- [x] I have read and understand the pull request rules.
Description
Fixes https://github.com/louislam/uptime-kuma/pull/5152#issuecomment-2401033137
Did not think about this because only the user can add these injections => why would anyone inject themselves, but better save than sorry.
I did not use any of the two packages, but rather rolled my own version.
-
execa
seems a bit too heavy for our usecase -
shell-escape
is doing something similar as I am doing, but what they are not handling that something like$HOME
which adds the home environment variable or the backticks which executes the shell can also escape the shell.
This is the result
curl --verbose --head --request GET \
--user-agent 'Uptime-Kuma/2.0.0-dev' \
--location --max-redirs 10 \
--max-time 48 \
--url 'https://google.com --not-injected \$Home \`exec\\\` \' <-> \" '
Type of change
Please delete any options that are not relevant.
- Bug fix (non-breaking change which fixes an issue)
Checklist
- [x] My code follows the style guidelines of this project
- [x] I ran ESLint and other linters for modified files
- [x] I have performed a self-review of my own code and tested it
- [x] I have commented my code, particularly in hard-to-understand areas (including JSDoc for methods)
- [x] My changes generates no new warnings