openwrt-mirror/luci
1
0
Fork 0
mirror of https://github.com/openwrt/luci.git synced 2025-12-21 19:14:34 +04:00
Code Issues Packages Projects Releases Wiki Activity

luci-proto-wireguard: fixed a vulnerability in the checkPeerHost method

Browse Source 
shellquote method is introduced so an injected code cannot be executed by the popen command.

Signed-off-by: Tom Haley <this_username_has_been_taken2@proton.me>
This commit is contained in:
Tom Haley
2024-12-04 22:19:25 +03:00
committed by Paul Donald
parent e76155d094
commit 101ea169c6
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
protocols/luci-proto-wireguard/root/usr/share/rpcd/ucode/luci.wireguard
View File

@@ -16,7 +16,7 @@ function command(cmd) {
}
function checkPeerHost(configHost, configPort, wgHost) {
const ips = popen(`resolveip ${configHost} 2>/dev/null`);
const ips = popen(`resolveip ${shellquote(configHost)} 2>/dev/null`);
const hostIp = replace(wgHost, /\[|\]/g, "");
if (ips) {
for (let line = ips.read('line'); length(line); line = ips.read('line')) {