milliways-infosec/AikidoSec-safe-chain
7
0
Fork 0
mirror of https://github.com/AikidoSec/safe-chain.git synced 2026-05-26 12:10:49 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Test if command is safe to execute

Browse source
This commit is contained in:
Sander Declerck 2025-10-24 17:36:51 +02:00
parent 7a55be49f4
commit f5f3b91b40
No known key found for this signature in database
2 changed files with 37 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

9
packages/safe-chain/src/utils/safeSpawn.js
View file

@ -27,6 +27,10 @@ function escapeDoubleQuoteContent(arg) {
}
function buildCommand(command, args) {
if (args.length === 0) {
return command;
}
const escapedArgs = args.map(sanitizeShellArgument);
return `${command} ${escapedArgs.join(" ")}`;
@ -48,6 +52,11 @@ function resolveCommandPath(command) {
}
export async function safeSpawn(command, args, options = {}) {
// command should always be alphanumeric or _ or - to avoid injection
if (!/^[a-zA-Z0-9_-]+$/.test(command)) {
throw new Error(`Invalid command name: ${command}`);
}
return new Promise((resolve, reject) => {
// Windows requires shell: true because .bat and .cmd files are not executable
// without a terminal. On Unix/macOS, we resolve the full path first, then use