milliways-infosec/AikidoSec-safe-chain
7
0
Fork 0
mirror of https://github.com/AikidoSec/safe-chain.git synced 2026-05-26 12:10:49 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Cleanup code, add some tests

Browse source
This commit is contained in:
Sander Declerck 2025-10-23 13:23:08 +02:00
parent c74c23b0ff
commit 08c1328b52
No known key found for this signature in database
2 changed files with 91 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

27
packages/safe-chain/src/utils/safeSpawn.js
View file

@ -1,22 +1,33 @@
import { spawn, execSync } from "child_process";
import os from "os";
function escapeArg(arg) {
// Shell metacharacters that need escaping
// These characters have special meaning in shells and need to be quoted
const shellMetaChars = /[ "&'|;<>()$`\\!*?[\]{}~#]/;
function sanitizeShellArgument(arg) {
// If argument contains shell metacharacters, wrap in double quotes
// and escape characters that are special even inside double quotes
if (shellMetaChars.test(arg)) {
if (hasShellMetaChars(arg)) {
// Inside double quotes, we need to escape: " $ ` \
return '"' + arg.replace(/(["`$\\])/g, "\\$1") + '"';
return '"' + escapeDoubleQuoteContent(arg) + '"';
}
return arg;
}
function hasShellMetaChars(arg) {
// Shell metacharacters that need escaping
// These characters have special meaning in shells and need to be quoted
// Whenever one of these characters is present, we should quote the argument
// Characters: space, ", &, ', |, ;, <, >, (, ), $, `, \, !, *, ?, [, ], {, }, ~, #
const shellMetaChars = /[ "&'|;<>()$`\\!*?[\]{}~#]/;
return shellMetaChars.test(arg);
}
function escapeDoubleQuoteContent(arg) {
// Escape special characters for shell safety
// This escapes ", $, `, and \ by prefixing them with a backslash
return arg.replace(/(["`$\\])/g, "\\$1");
}
function buildCommand(command, args) {
const escapedArgs = args.map(escapeArg);
const escapedArgs = args.map(sanitizeShellArgument);
return `${command} ${escapedArgs.join(" ")}`;
}