Security Issue: Arbitrary shell command execution

[BlueCocoa]

Affected: Versions with you-get enabled

Reproducible: YES

POC

Steps:

1. Enable you-get feature
2. Add new task
3. type [ANY URL] & [ANY SHELL COMMAND]

for example, http://www.bilibili.com/video/av7265606/ & touch ~/vulnerable
will create a file named vulnerable in user's home directory.

Related code

in YouGet.swift

private func sh(command: String) -> String?

function sh takes an arbitrary string and pass it as the second argument to /bin/sh -c

Solution

Maybe the best way, add slashes or escapes for any user input.

[BlueCocoa]

貌似文件权限略坑，你参考这个commit修吧😂