Potential for command injection in printer/package/lib/printer.js

[nodesecurity]

Overview

Untrusted input passed in to the printer attribute of the first argument to printDirect module can allow for command injection. This may be unexpected behavior for the caller.

Confirmed on version 0.0.1

Confirmed vulnerable. Examples:

var printer = require("printer");
printer.printDirect({data:"print from Node.JS"
, printer:"`ping google.com`"
, type: "TEXT"
, success:function(){
console.log("ok");
}
, error:function(err){console.log(err);}
});

Recommendation

• If you do not need to execute within a subshell, it's recommended to
  usechild_process.execFile and pass in the arguments array.

Credit: Node Security Auditor

Adam Baldwin

Questions? Hit us up in #nodesecurity on freenode or email info@nodesecurity.io and reference this issue.

The Node Security Project
nodesecurity.io
@nodesecurity

[tojocky]

Thanks for Pull request

[nodesecurity]

Sorry for the double email, I miscommunicated to the node security
project team.

Ion wrote:

Thanks for Pull request

—
Reply to this email directly or view it on GitHub
#1 (comment).