Skip to content

Commit a6668ca

Browse files
SteinRobertSteinRobert
committed
fix: security vulnerability for cli (windows, mac and linux)
Fixes command line injection issue (https://www.npmjs.com/advisories/952) and applies `npm run prettier:fix` to files.
1 parent f6af03c commit a6668ca

13 files changed

+143
-114
lines changed

‎src/linux-connect.js‎

Lines changed: 13 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,23 @@
1-
var exec = require('child_process').exec;
1+
var execFile = require('child_process').execFile;
22
var env = require('./env');
33

44
function connectToWifi(config, ap, callback) {
5-
var commandStr =
6-
"nmcli -w 10 device wifi connect '" +
7-
ap.ssid +
8-
"'" +
9-
' password ' +
10-
"'" +
11-
ap.password +
12-
"'";
5+
var args = [];
6+
args.push('-w');
7+
args.push('10');
8+
args.push('device');
9+
args.push('wifi');
10+
args.push('connect');
11+
args.push(ap.ssid);
12+
args.push('password');
13+
args.push(ap.password);
1314

1415
if (config.iface) {
15-
commandStr = commandStr + ' ifname ' + config.iface;
16+
args.push('ifname');
17+
args.push(config.iface);
1618
}
1719

18-
exec(commandStr, { env: env }, function(err, resp) {
20+
execFile('nmcli', args, { env: env }, function(err, resp) {
1921
// Errors from nmcli came from stdout, we test presence of 'Error: ' string
2022
if (resp.includes('Error: ')) {
2123
err = new Error(resp.replace('Error: ', ''));

‎src/linux-current-connections.js‎

Lines changed: 14 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,24 @@
1-
var exec = require('child_process').exec;
1+
var execFile = require('child_process').execFile;
22
var networkUtils = require('./network-utils');
33
var env = require('./env');
44

55
function getCurrentConnection(config, callback) {
6-
var commandStr =
7-
'nmcli --terse --fields active,ssid,bssid,mode,chan,freq,signal,security,wpa-flags,rsn-flags,device device wifi';
6+
var args = [];
7+
args.push('--terse');
8+
args.push('--fields');
9+
args.push(
10+
'active,ssid,bssid,mode,chan,freq,signal,security,wpa-flags,rsn-flags,device'
11+
);
12+
args.push('device');
13+
args.push('wifi');
14+
815
if (config.iface) {
9-
commandStr += ' list ifname ' + config.iface;
16+
args.push('list');
17+
args.push('ifname');
18+
args.push(config.iface);
1019
}
1120

12-
exec(commandStr, { env }, function(err, scanResults) {
21+
execFile('nmcli', args, { env }, function(err, scanResults) {
1322
if (err) {
1423
callback && callback(err);
1524
return;

‎src/linux-delete.js‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,15 @@
1-
var exec = require('child_process').exec;
1+
var execFile = require('child_process').execFile;
22
var env = require('./env');
33

44
function deleteConnection(config, ap, callback) {
5-
var commandStr = 'nmcli connection delete id ';
5+
var args = [];
6+
args.push('connection');
7+
args.push('delete');
8+
args.push('id');
69

7-
commandStr += ' ' + "'" + ap.ssid + "'";
10+
args.push(ap.ssid);
811

9-
exec(commandStr, env, function(err) {
12+
execFile('nmcli', args, env, function(err) {
1013
callback && callback(err);
1114
});
1215
}

‎src/linux-disconnect.js‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,16 @@
1-
var exec = require('child_process').exec;
1+
var execFile = require('child_process').execFile;
22
var env = require('./env');
33

44
function disconnect(config, callback) {
5-
var commandStr = 'nmcli device disconnect';
5+
var args = [];
6+
args.push('device');
7+
args.push('disconnect');
68

79
if (config.iface) {
8-
commandStr += ' ' + config.iface;
10+
args.push(config.iface);
911
}
1012

11-
exec(commandStr, { env }, function(err) {
13+
execFile('nmcli', args, { env }, function(err) {
1214
callback && callback(err);
1315
});
1416
}

‎src/linux-scan.js‎

Lines changed: 14 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,24 @@
1-
var exec = require('child_process').exec;
1+
var execFile = require('child_process').execFile;
22
var networkUtils = require('./network-utils');
33
var env = require('./env');
44

55
function scanWifi(config, callback) {
6-
var commandStr =
7-
'nmcli --terse --fields active,ssid,bssid,mode,chan,freq,signal,security,wpa-flags,rsn-flags device wifi list';
6+
var args = [];
7+
args.push('--terse');
8+
args.push('--fields');
9+
args.push(
10+
'active,ssid,bssid,mode,chan,freq,signal,security,wpa-flags,rsn-flags'
11+
);
12+
args.push('device');
13+
args.push('wifi');
14+
args.push('list');
15+
816
if (config.iface) {
9-
commandStr += ' ifname ' + config.iface;
17+
args.push('ifname');
18+
args.push(config.iface);
1019
}
1120

12-
exec(commandStr, { env }, function(err, scanResults) {
21+
execFile('nmcli', args, { env }, function(err, scanResults) {
1322
if (err) {
1423
callback && callback(err);
1524
return;

‎src/mac-connect.js‎

Lines changed: 6 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,31 +1,18 @@
1-
var exec = require('child_process').exec;
1+
var execFile = require('child_process').execFile;
22
var env = require('./env');
33

44
function connectToWifi(config, ap, callback) {
55
var iface = 'en0';
6-
var commandStr = 'networksetup -setairportnetwork ';
6+
var args = ['-setairportnetwork'];
77

88
if (config.iface) {
99
iface = config.iface.toString();
1010
}
11+
args.push(iface);
12+
args.push(ap.ssid);
13+
args.push(ap.password);
1114

12-
commandStr =
13-
commandStr +
14-
"'" +
15-
iface +
16-
"'" +
17-
' ' +
18-
"'" +
19-
ap.ssid +
20-
"'" +
21-
' ' +
22-
"'" +
23-
ap.password +
24-
"'";
25-
//console.log(commandStr);
26-
27-
exec(commandStr, { env }, function(err, resp) {
28-
//console.log(stderr, resp);
15+
execFile('networksetup', args, { env }, function(err, resp) {
2916
if (resp && resp.indexOf('Failed to join network') >= 0) {
3017
callback && callback(resp);
3118
} else if (resp && resp.indexOf('Could not find network') >= 0) {

‎src/mac-current-connections.js‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
var exec = require('child_process').exec;
1+
var execFile = require('child_process').execFile;
22
var macProvider =
33
'/System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport';
44
var env = require('./env');
@@ -48,9 +48,9 @@ function parseAirport(stdout) {
4848
}
4949

5050
function getCurrentConnections(config, callback) {
51-
var commandStr = macProvider + ' --getinfo';
51+
var args = ['--getinfo'];
5252

53-
exec(commandStr, env, function(err, stdout) {
53+
execFile(macProvider, args, env, function(err, stdout) {
5454
if (err) {
5555
callback && callback(err);
5656
} else {

‎src/mac-delete.js‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,18 @@
1-
var exec = require('child_process').exec;
1+
var execFile = require('child_process').execFile;
22
var env = require('./env');
33

44
function deleteConnection(config, ap, callback) {
55
var iface = 'en0';
6-
var commandStr = 'networksetup -removepreferredwirelessnetwork ';
6+
var args = ['-removepreferredwirelessnetwork'];
77

88
if (config.iface) {
99
iface = config.iface.toString();
1010
}
1111

12-
commandStr = commandStr + "'" + iface + "'" + ' ' + "'" + ap.ssid + "'";
12+
args.push(iface);
13+
args.push(ap.ssid);
1314

14-
exec(commandStr, env, function(err, resp) {
15+
execFile('networksetup', args, env, function(err, resp) {
1516
if (
1617
resp &&
1718
resp.indexOf('was not found in the preferred networks list') >= 0

‎src/mac-scan.js‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
1-
var exec = require('child_process').exec;
1+
var execFile = require('child_process').execFile;
22
var macProvider =
33
'/System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport';
44
var networkUtils = require('./network-utils.js');
55
var env = require('./env');
66

77
function scanWifi(config, callback) {
8-
exec(macProvider + ' -s', { env }, function(err, scanResults) {
8+
execFile(macProvider, ['-s'], { env }, function(err, scanResults) {
99
if (err) {
1010
callback && callback(err);
1111
}

‎src/windows-connect.js‎

Lines changed: 26 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
var fs = require('fs');
2-
var exec = require('child_process').exec;
2+
var execFile = require('child_process').execFile;
33
var env = require('./env');
44
var scan = require('./windows-scan');
55

6-
function execCommand(cmd) {
6+
function execCommand(cmd, params) {
77
return new Promise(function(resolve, reject) {
8-
exec(cmd, { env }, function(err, stdout, stderr) {
8+
execFile(cmd, params, { env }, function(err, stdout, stderr) {
99
if (err) {
1010
// Add command output to error, so it's easier to handle
1111
err.stdout = stdout;
@@ -36,17 +36,25 @@ function connectToWifi(config, ap, callback) {
3636
);
3737
})
3838
.then(function() {
39-
return execCommand(
40-
'netsh wlan add profile filename="nodeWifiConnect.xml"'
41-
);
39+
return execCommand('netsh', [
40+
'wlan',
41+
'add',
42+
'profile',
43+
'filename="nodeWifiConnect.xml"'
44+
]);
4245
})
4346
.then(function() {
44-
var cmd =
45-
'netsh wlan connect ssid="' + ap.ssid + '" name="' + ap.ssid + '"';
47+
var cmd = 'cmd';
48+
var params = [
49+
'wlan',
50+
'connect',
51+
'ssid="' + ap.ssid + '"',
52+
'name="' + ap.ssid + '"'
53+
];
4654
if (config.iface) {
47-
cmd += ' interface="' + config.iface + '"';
55+
params.push('interface="' + config.iface + '"');
4856
}
49-
return execCommand(cmd);
57+
return execCommand(cmd, params);
5058
})
5159
.then(function() {
5260
return execCommand('del ".\\nodeWifiConnect.xml"');
@@ -55,9 +63,14 @@ function connectToWifi(config, ap, callback) {
5563
callback && callback();
5664
})
5765
.catch(function(err) {
58-
exec('netsh wlan delete profile "' + ap.ssid + '"', { env }, function() {
59-
callback && callback(err);
60-
});
66+
execFile(
67+
'netsh',
68+
['wlan', 'delete', 'profile "' + ap.ssid + '"'],
69+
{ env },
70+
function() {
71+
callback && callback(err);
72+
}
73+
);
6174
});
6275
}
6376

0 commit comments

Comments
 (0)