From f4330a4678d5e4afa9c564a85de974c343ec2348 Mon Sep 17 00:00:00 2001 From: DuLinRain Date: Tue, 26 Jan 2021 20:42:18 +0800 Subject: [PATCH 1/2] fix: add defence to Command Injection Attack add defence to Command Injection Attack according to https://snyk.io/vuln/SNYK-JS-CURLJS-1050404 --- index.js | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/index.js b/index.js index 6fe063a..c631aa8 100755 --- a/index.js +++ b/index.js @@ -28,6 +28,10 @@ var curl = function(url, options, callback) { var opts = new optionsBuilder(); options = opts.follow_redirects().silent().max_redirs(5).connect_timeout(5); } + + if (/[`$&{}[;|]/g.test(url)) { + return callback(new Error('Invalid Url'), null, null); + } var curlString = 'curl "' + url + '" '; From 34cfefe015f667a9b22404210355b2732249922c Mon Sep 17 00:00:00 2001 From: DuLinRain Date: Tue, 26 Jan 2021 20:44:36 +0800 Subject: [PATCH 2/2] feat: add test case for Command Injection Attack feat: add test case for Command Injection Attack --- tests/testCurl.js | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/tests/testCurl.js b/tests/testCurl.js index 183c698..dd81814 100644 --- a/tests/testCurl.js +++ b/tests/testCurl.js @@ -26,4 +26,9 @@ curl("www.google.com", opts, function(err, resp) { }) opts.follow_redirects(false); -assert.equal(opts.stringify().trim(), "-v -S -k --proxy-ntlm -ntlm --connect-timeout 3 --max-redirs 10"); \ No newline at end of file +assert.equal(opts.stringify().trim(), "-v -S -k --proxy-ntlm -ntlm --connect-timeout 3 --max-redirs 10"); + +curl("www.google.com' & touch test.txt #'", function(err, resp) { + assert.notEqual(err, null, "there should be errors from curling with unsafe url"); + assert.equal(resp, null, "curling with unsafe url should return error"); +});