Fix arbitrary command injection, CWE-264

flypapertech · May 14, 2018 · 99b23e6 · mikroskeem · Jun 11, 2018 · 99b23e6
1 parent dd07962
commit 99b23e6
Show file tree

Hide file tree

Showing 4 changed files with 9 additions and 9 deletions.
diff --git a/lib/linux.js b/lib/linux.js
@@ -1,11 +1,11 @@
-var exec = require('child_process').exec;
+var execFile = require('child_process').execFile;
 
 module.exports = function (iface, callback) {
-    exec("cat /sys/class/net/" + iface + "/address", function (err, out) {
+    execFile("cat", ["/sys/class/net/", iface, "/address"], function (err, out) {
         if (err) {
             callback(err, null);
             return;
         }
         callback(null, out.trim().toLowerCase());
     });
-};
+};
diff --git a/lib/macosx.js b/lib/macosx.js
@@ -1,7 +1,7 @@
-var exec = require('child_process').exec;
+var execFile = require('child_process').execFile;
 
 module.exports = function (iface, callback) {
-    exec("networksetup -getmacaddress " + iface, function (err, out) {
+    execFile("networksetup", ["-getmacaddress", iface], function (err, out) {
         if (err) {
             callback(err, null);
             return;

diff --git a/lib/unix.js b/lib/unix.js
@@ -1,7 +1,7 @@
-var exec = require('child_process').exec;
+var execFile = require('child_process').execFile;
 
 module.exports = function (iface, callback) {
-    exec("ifconfig " + iface, function (err, out) {
+    execFile("ifconfig", [iface], function (err, out) {
         if (err) {
             callback(err, null);
             return;

diff --git a/lib/windows.js b/lib/windows.js
@@ -1,4 +1,4 @@
-var exec = require('child_process').exec;
+var execFile = require('child_process').execFile;
 
 var regexRegex = /[-\/\\^$*+?.()|[\]{}]/g;
 
@@ -7,7 +7,7 @@ function escape(string) {
 }
 
 module.exports = function (iface, callback) {
-    exec("ipconfig /all", function (err, out) {
+    execFile("ipconfig", ["/all"], function (err, out) {
         if (err) {
             callback(err, null);
             return;