From 74b7cd8e81840537a8206317344f118093153e8d Mon Sep 17 00:00:00 2001 From: Oleg Lobanov Date: Sun, 31 Oct 2021 17:13:16 +0100 Subject: [PATCH] fix: security issue in command runner (closes #1621) --- http/commands.go | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/http/commands.go b/http/commands.go index 173e57a9..48c7f297 100644 --- a/http/commands.go +++ b/http/commands.go @@ -59,14 +59,6 @@ var commandsHandler = withUser(func(w http.ResponseWriter, r *http.Request, d *d } } - if !d.server.EnableExec || !d.user.CanExecute(strings.Split(raw, " ")[0]) { - if err := conn.WriteMessage(websocket.TextMessage, cmdNotAllowed); err != nil { //nolint:govet - wsErr(conn, r, http.StatusInternalServerError, err) - } - - return 0, nil - } - command, err := runner.ParseCommand(d.settings, raw) if err != nil { if err := conn.WriteMessage(websocket.TextMessage, []byte(err.Error())); err != nil { //nolint:govet @@ -75,6 +67,14 @@ var commandsHandler = withUser(func(w http.ResponseWriter, r *http.Request, d *d return 0, nil } + if !d.server.EnableExec || !d.user.CanExecute(command[0]) { + if err := conn.WriteMessage(websocket.TextMessage, cmdNotAllowed); err != nil { //nolint:govet + wsErr(conn, r, http.StatusInternalServerError, err) + } + + return 0, nil + } + cmd := exec.Command(command[0], command[1:]...) //nolint:gosec cmd.Dir = d.user.FullPath(r.URL.Path)