patch: fixes possible injection issue for notify-send

mikaelbr · Mar 11, 2021 · c4b8ade · c4b8ade
1 parent 1101e6d
commit c4b8ade
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 1 deletion.
diff --git a/lib/utils.js b/lib/utils.js
@@ -285,7 +285,9 @@ module.exports.constructArgumentList = function(options, extra) {
   };
 
   initial.forEach(function(val) {
-    args.push(escapeFn(val));
+    if (typeof val === 'string') {
+      args.push(escapeFn(val));
+    }
   });
   for (var key in options) {
     if (

diff --git a/test/notify-send.js b/test/notify-send.js
@@ -71,6 +71,17 @@ describe('notify-send', function() {
     notifier.notify({ title: 'title', message: 'body', icon: 'icon-string' });
   });
 
+  it('should only include strings as arguments', function(done) {
+    var expected = ['"HACKED"'];
+
+    expectArgsListToBe(expected, done);
+    var notifier = new Notify({ suppressOsdCheck: true });
+    var options = JSON.parse(
+      '{"title":"HACKED", "message":["`touch HACKED`"]}'
+    );
+    notifier.notify(options);
+  });
+
   it('should remove extra options that are not supported by notify-send', function(done) {
     var expected = [
       '"title"',