Comments (1)
Sounds fair. I do not like the whole idea of passing userdata to shell
commands myself. It is just so useful at times to be able to write shell
oneliners in lua scripts before processing output that this is allowed
using this shell method but I want all such things to go through this
single function where we do proper escaping of all the special symbols.
Also, this core lua library is now part of the rpc server backend here:
https://github.com/mkschreder/orangerpcd/blob/master/lualib/orange/core.lua
so I'm removing obsolete copies of these files from this repo.
As I'm adding more unit tests right now, it would be great to do proper
coverage of all possible test cases. I will be adding tests for lua part
shortly. Unit tests are currently run by travis:
https://travis-ci.org/mkschreder/orangerpcd and coverage is uploaded to
coveralls.io: https://coveralls.io/github/mkschreder/orangerpcd.
On 3 Sep 2016 11:24, "nelicacs" [email protected] wrote:
As the comment on the line 80 says, the currently used blacklist approach
is dangerous. There are many other symbols (e.g. backtick, ampersand etc)
and symbol sequences (e.g "$()") that can be used to perform OS command
injection attacks. For example using "127.0.0.1 && /bin/cat /etc/shadow" as
the host parameter value in /plugins/juci-diagnostics/rpc/diagnostics.lua
causes displaying the shadow file contents.Recommendation: consider using whitelist based approach instead of a
blacklist. In case any of the arguments contain a symbol that is not in a
specified whitelist, drop all arguments and raise an error.—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
#58, or mute the thread
https://github.com/notifications/unsubscribe-auth/AERqiWJFpMdPptwKEniFfTn9hznMTZOxks5qmTzMgaJpZM4J0Q8j
.
from juci.
Related Issues (20)
- I visit the home page and can not see anything. The homepage is blank.Also the console does not have any errors HOT 4
- Compile error juci on lede project HOT 4
- Spinning circle HOT 1
- autologon HOT 1
- plugins/juci-openwrt-wireless/src/widgets/overview.wifi.js HOT 1
- error libblobpack HOT 4
- UCI failed! HOT 15
- ng-tags-input.css.map 404 HOT 1
- Compiling JUCI in LEDE HOT 10
- LEDE Compile Deprecated error & missing library HOT 4
- UCI failed to initialize HOT 2
- Network connections page protocols error. HOT 3
- New plugin HOT 3
- Compiling Error with LEDE HOT 4
- Unable to build HOT 9
- JUCI Webpages fail to get information for interfaces on OpenWRT 18.06.02 HOT 1
- Development stopped? HOT 1
- Make dependency which does not exist HOT 1
- firefox visit openwrt juci got a running cycle. F12 network print these messages: HOT 2
- juci project no more update? HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from juci.