All geek questions in one place

Failure to properly prevent shell injection

I need to run some shell commands from a Lua interpreter embedded in another Mac / Windows application, where shell commands are the only way to achieve certain things, for example, opening a help page in a browser. If I have a list of arguments (which may be the result of user input), how can I avoid each argument to prevent problems?

Inspired by this article , a simple solution is to avoid all non-alphanumeric characters, on Unix-like systems with \, on Windows with ^. As far as I can tell, this will prevent any argument from invoking

  • execution of another command due to newline intervention, ;(Unix) or &(Windows)
  • replacing a command on Unix with $or`
  • Assessing variables in Windows with %
  • redirection with <, |and>

In addition, any character that acts as an escape character on the appropriate platform will be escaped properly.

It seems to me that this sounds to me, but are there any pitfalls that I may have missed? I know that in bash, \followed by a new line, it will effectively delete the new line, which is not a problem here.

EDIT

: , , escape-, Windows, * nix. , , Windows , , Windows , .

:

, , , , .

+4
1

, . Python, , os.system() , subprocess . , subprocess.run() , , .

subprocess Lua, lua-subprocess, , , , , .

, Python shlex.quote() () - :

# use single quotes, and put single quotes into double quotes
# the string $'b is then quoted as '$'"'"'b'
return "'" + s.replace("'", "'\"'\"'") + "'"

Lua.

+1

Source: https://habr.com/ru/post/1625109/

More articles:


All Articles