Fix Command Injection vulnerability

[EffectRenan]

📊 Metadata *

find-process is a library to get information about running processes by PID number, port number or a string value.

Bounty URL: https://www.huntr.dev/bounties/1-npm-find-process/

⚙️ Description *

To get information by PID and port number, the user needs to inform a value, which is used in a concatenation of an OS command. There is no user input check to know if the PID or the port is a number, so the attacker may send a malicious string that will be interpreted as an OS command.

💻 Technical Description *

The fix provided checks if the user input is a number for the find calls using PID or port, which returns in a rejected promise for false checks.

PS: The find function for name is not vulnerable.

🐛 Proof of Concept (PoC) *

const find = require('find-process');
const command = "$(touch poc.txt)";

find('pid', command)
  .then(function (list) {
    console.log(list);
  }, function (err) {
    console.log(err.stack || err);
  })

🔥 Proof of Fix (PoF) *

The execution of the PoC will not imply the creation of the poc.txt file.

👍 User Acceptance Testing (UAT)

const find = require('find-process');

find('pid', 1)
  .then(function (list) {
    console.log(list);
  }, function (err) {
    console.log(err.stack || err);
  })

find('port', 80)
  .then(function (list) {
    console.log(list);
  }, function (err) {
    console.log(err.stack || err);
  })

find('name', "docker")
  .then(function (list) {
    console.log(list);
  }, function (err) {
    console.log(err.stack || err);
  })

[huntr-helper]

👋 Hello, @yibn2008. @EffectRenan has opened a PR to us with a fix for a potential vulnerability in your repository. To view the vulnerability, please refer to the bounty URL in the first comment, above. If you want this fix in your repository, a PR will automatically open once you comment:

@huntr-helper - LGTM

---

☎️ Need further support?

Come and join us on our community Discord!

---

❓@yibn2008 - want more fixes like this?

Copy this snippet into your README.md for more vulnerability fixes in the future:

[![huntr](https://cdn.huntr.dev/huntr_security_badge_mono.svg)](https://huntr.dev)

[yibn2008]

@huntr-helper - LGTM