From 37f65e7930cfac315ca8873b2d556849cc5529f7 Mon Sep 17 00:00:00 2001 From: Alejandro Romero Herrera Date: Wed, 9 Sep 2020 19:10:20 +0300 Subject: [PATCH 1/2] Fix Arbitary Code Execution --- index.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/index.js b/index.js index d11c8a3..75b0405 100644 --- a/index.js +++ b/index.js @@ -121,7 +121,7 @@ exports.build = function build(argv, callback) { pack = true; break; case 'O': - onto = option.optarg; + onto = option.optarg.replace(/'|"|;|&|,|\\|\|/gi, ''); break; case 'c': commit = true; From 2baac34b5e88fefc938d0ce0396388169426b6ce Mon Sep 17 00:00:00 2001 From: Alejandro Romero Herrera Date: Thu, 17 Sep 2020 18:07:48 +0300 Subject: [PATCH 2/2] Whitelist alphanumeric chars --- index.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/index.js b/index.js index 75b0405..027eef0 100644 --- a/index.js +++ b/index.js @@ -121,7 +121,7 @@ exports.build = function build(argv, callback) { pack = true; break; case 'O': - onto = option.optarg.replace(/'|"|;|&|,|\\|\|/gi, ''); + onto = option.optarg.replace(/[^\w]/gi, ''); break; case 'c': commit = true;