xuans/Scert
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

修复SSH脚本命令参数校验

Browse Source
This commit is contained in:
xuans 2026-09-30 16:48:18 +08:00
parent 532bfbe0b1
commit ac62380c0d
2 changed files with 9 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
backend/internal/deployment/ssh.go
View File

@ -420,8 +420,8 @@ func (c *sshClientAdapter) Close() error {
}
func validateCommand(command []string) error {
for _, token := range command {
if strings.TrimSpace(token) == "" || strings.ContainsAny(token, "\x00\r\n") {
for index, token := range command {
if strings.TrimSpace(token) == "" || strings.ContainsRune(token, '\x00') || (strings.ContainsAny(token, "\r\n") && !(len(command) == 3 && index == 2 && command[0] == "sh" && command[1] == "-c")) {
return errors.New("远程命令参数无效")
}
}

7
backend/internal/deployment/ssh_test.go
View File

@ -59,6 +59,13 @@ func TestValidateCommandRejectsShellControlLines(t *testing.T) {
}
}
func TestValidateCommandAllowsShellScriptArgument(t *testing.T) {
command := []string{"sh", "-c", "set -eu\nprintf '%s\\n' 'ok'"}
if err := validateCommand(command); err != nil {
t.Fatalf("shell script argument should be accepted: %v", err)
}
}
func TestJoinShellArgsQuotesArguments(t *testing.T) {
command := []string{"nginx", "-c", "/etc/nginx/my config.conf", "reload'check"}
joined := joinShellArgs(command)