Conversation
NamSupawan
force-pushed
the
fetch/update
branch
from
a835e78 to
44ea424
Compare
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| def get_allowed_ip_addresses(name) | ||
| command = "sudo ipset list #{name} | awk 'NR > 7 { print $1 }'" | ||
|
|
||
| output, status = Open3.capture2e(command) |
Check failure
Code scanning / CodeQL
Uncontrolled command line Critical
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 1 year ago
To fix the problem, we need to ensure that user input is not directly used to construct and execute shell commands. Instead, we should validate and sanitize the user input to ensure it is safe. One way to do this is to use a whitelist of allowed values or to use parameterized commands where possible.
In this specific case, we can validate the rules_name parameter to ensure it only contains safe characters (e.g., alphanumeric characters and underscores). This will prevent any malicious input from being executed as a command.
| @@ -46,3 +46,3 @@ | ||
|
|
||
| if rules_name | ||
| if rules_name && rules_name.match?(/\A\w+\z/) | ||
| @allowed_ips_output = get_allowed_ip_addresses(rules_name) | ||
| @@ -66,5 +66,6 @@ | ||
| def get_allowed_ip_addresses(name) | ||
| command = "sudo ipset list #{name} | awk 'NR > 7 { print $1 }'" | ||
| command = ["sudo", "ipset", "list", name] | ||
| awk_command = "awk 'NR > 7 { print $1 }'" | ||
|
|
||
| output, status = Open3.capture2e(command) | ||
| output, status = Open3.capture2e(command.join(' ') + " | " + awk_command) | ||
|
|
| config_file = params[:config_file] | ||
| output, status = Open3.capture2e("sudo wg-quick up #{config_file}") | ||
|
|
||
| output, status = Open3.capture2e("sudo wg-quick up #{config_file}") |
Check failure
Code scanning / CodeQL
Uncontrolled command line Critical
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 10 months ago
To fix the issue, we need to ensure that the config_file parameter is validated and sanitized before being used in the shell command. The best approach is to:
- Validate the
config_fileparameter to ensure it only contains safe, expected values (e.g., filenames or paths). - Avoid direct interpolation of user input into the shell command. Instead, use an array form of
Open3.capture2eto safely pass arguments to the command, which avoids shell interpretation.
The changes will involve:
- Adding validation logic for
config_fileto ensure it is a valid filename or path. - Modifying the
Open3.capture2ecall to use the array form for safer command execution.
| @@ -52,3 +52,6 @@ | ||
| config_file = params[:config_file] | ||
| output, status = Open3.capture2e("sudo wg-quick up #{config_file}") | ||
| unless config_file =~ /\A[\w\-.\/]+\z/ | ||
| redirect_to new_vpn_device_path, alert: 'Invalid configuration file name.' and return | ||
| end | ||
| output, status = Open3.capture2e('sudo', 'wg-quick', 'up', config_file) | ||
| if status.success? |
2 participants
No description provided.