Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[v15] Quote user supplied inputs provided to scripts to avoid RCE #39837

Merged
merged 3 commits into from Mar 26, 2024
Merged

[v15] Quote user supplied inputs provided to scripts to avoid RCE #39837

merged 3 commits into from Mar 26, 2024

Commits on Mar 26, 2024

  1. Quote user supplied inputs provided to scripts to avoid RCE 

    This change introduces the func `utils.UnixShellQuote` which will quote any inputs which could potentially allow execution or script escape.
This is utilized to ensure that scripts produced from a potential Phishing link could not contain code execution which may expose a user.
    @jentfoo
    jentfoo authored and github-actions committed Mar 26, 2024
    Configuration menu
    Copy the full SHA
    df7910b View commit details
    Browse the repository at this point in the history

  2. awsAccessGraphOIDCSync: Ensure role parameter is quoted correctly

    @jentfoo
    jentfoo authored and github-actions committed Mar 26, 2024
    Configuration menu
    Copy the full SHA
    6b3ae00 View commit details
    Browse the repository at this point in the history

  3. join_tokens: Move shell quote to getJoinScript rather than where pa… 

    …rameters are extracted

This will increase safety moving forward, but it requires a more conservative quoting strategy.
    @jentfoo
    jentfoo authored and github-actions committed Mar 26, 2024
    Configuration menu
    Copy the full SHA
    161313b View commit details
    Browse the repository at this point in the history