From 3d39e8c38cfa276d5cdfad7105dbf47933eaed4f Mon Sep 17 00:00:00 2001 From: Jo-Philipp Wich Date: Mon, 20 Jul 2026 21:19:18 +0200 Subject: [PATCH] luci-app-ddns: use array form of system() for invocations with user values Convert system() calls in killcmd() and get_services_status from string interpolation to the array form to avoid shell interpretation of user-controlled procid, signal, lookupHost, section, and dnsServer parameters. (cherry picked from commit 80a3b58eed8a87a9f60c8efa0064e2e3126d5102) --- applications/luci-app-ddns/root/usr/share/rpcd/ucode/ddns.uc | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/applications/luci-app-ddns/root/usr/share/rpcd/ucode/ddns.uc b/applications/luci-app-ddns/root/usr/share/rpcd/ucode/ddns.uc index 3978672200..76aa309787 100644 --- a/applications/luci-app-ddns/root/usr/share/rpcd/ucode/ddns.uc +++ b/applications/luci-app-ddns/root/usr/share/rpcd/ucode/ddns.uc @@ -31,7 +31,7 @@ function killcmd(procid, signal) { signal = 0; } // by default, we simply re-nice a process to check it is running - return system(`kill -${signal} ${procid}`); + return system(['kill', `-${signal}`, procid]); } function trimnonewline(input) { @@ -134,7 +134,7 @@ const methods = { if (length(dnsServer) > 0) push(command, '-d', dnsServer); push(command, '-- get_registered_ip'); - const result = system(`${join(' ', command)}`); + const result = system(command); } lastUpdate = int(readfile(`${rundir}/${section}.update`) || 0);