mroot/yazi
1
0
Fork 0
mirror of https://github.com/sxyazi/yazi.git synced 2026-07-25 08:41:05 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

prevent arbitrary code execution when expanding path

Browse source
This commit is contained in:
Nguyen Duc Toan 2023-10-04 00:05:07 +07:00 • committed by sxyazi
parent ba3a08403b
commit 4fb835ee64
No known key found for this signature in database
1 changed files with 29 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

33
shared/src/fns.rs
View file

@ -10,11 +10,19 @@ pub fn expand_path(p: impl AsRef<Path>) -> PathBuf {
// expand the environment variable by calling the "echo" command, in linux case, this also expands the '~' path
#[cfg(target_os = "windows")]
let expanded_path = match std::process::Command::new("cmd").args(&["/C", "echo"]).arg(p).output() {
Ok(output) if output.status.success() => Some(String::from_utf8_lossy(&output.stdout).trim_end().to_string()),
Ok(output) if output.status.success() => Some(String::from_utf8_lossy(&output.stdout)
.trim_end()
.trim_matches('"')
.replace("\\\"", "\"")
.to_string()
),
_ => None,
};
#[cfg(not(target_os = "windows"))]
let expanded_path = match std::process::Command::new("sh").arg("-c").arg(format!("echo {}", p.display())).output() {
let expanded_path = match std::process::Command::new("sh")
.arg("-c")
.arg(format!("echo \"{}\"", p.to_string_lossy().replace("\"", "\\\"")))
.output() {
Ok(output) if output.status.success() => Some(String::from_utf8_lossy(&output.stdout).trim_end().to_string()),
_ => None,
};
@ -160,9 +168,11 @@ pub fn optional_bool(s: &str) -> Option<bool> {
#[cfg(test)]
mod tests {
use std::{borrow::Cow, path::Path};
use std::{borrow::Cow, path::Path, env};
use super::path_relative_to;
use crate::expand_path;
use super::path_relative_to;
#[cfg(unix)]
#[test]
@ -191,4 +201,19 @@ mod tests {
assert("C:\\a", "C:\\a\\b\\c", "..\\..\\");
assert("C:\\a\\a\\b", "C:\\a\\b\\b", "..\\..\\a\\b");
}
#[test]
fn test_expand_path() {
let path_s = r#"a"b"#;
assert_eq!(expand_path(path_s), env::current_dir().unwrap().join(std::path::Path::new(path_s)));
let path_s = r#"a'b"#;
assert_eq!(expand_path(path_s), env::current_dir().unwrap().join(std::path::Path::new(path_s)));
let path_s = r#"a; x b"#;
assert_eq!(expand_path(path_s), env::current_dir().unwrap().join(std::path::Path::new(path_s)));
let path_s = r#"a && x b"#;
assert_eq!(expand_path(path_s), env::current_dir().unwrap().join(std::path::Path::new(path_s)));
}
}