svrjs/redbrick
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Activity Actions

Narrowed down conditions for CGI execution for security reasons

Browse source
This commit is contained in:
Dorian Niemiec 2023-08-30 17:34:56 +02:00
parent b4de66359d
commit 9381b3dec0
1 changed files with 11 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
index.js
View file

@ -56,14 +56,15 @@ Mod.prototype.callback = function (req, res, serverconsole, responseEnd, href, e
".sh": ["bash"],
".ksh": ["ksh"],
".csh": ["csh"],
".bat": ["cmd", "/c"],
".cmd": ["cmd", "/c"],
".vbs": ["cscript"],
".jar": ["java"],
".pyw": ["python"],
".rb": ["ruby"],
".php": ["php-cgi"]
};
if(os.platform() == "win32") {
exttointerpreter[".exe"] = [];
exttointerpreter[".bat"] = ["cmd", "/c"];
exttointerpreter[".cmd"] = ["cmd", "/c"];
exttointerpreter[".vbs"] = ["cscript"];
}
var exttointerpreteruser = {};
fs.readFile(__dirname + "/../../../redbrick-interpreters.json", function (err, data) {
if (!err) {
@ -115,7 +116,7 @@ Mod.prototype.callback = function (req, res, serverconsole, responseEnd, href, e
return arg.replace(/"/g, "");
});
afterShebangCallback(args);
} else if (line.substr(0, 2) == "MZ" || line.substr(0, 4) == "\x7fELF") {
} else if (os.platform() != "win32" && line.substr(0, 4) == "\x7fELF") {
afterShebangCallback("binary");
} else {
afterShebangCallback(false);
@ -146,7 +147,10 @@ Mod.prototype.callback = function (req, res, serverconsole, responseEnd, href, e
}
} else {
args = exttointerpreteruser[ext];
if (!args) {
if (args === null) {
elseCallback();
return;
} else if (!args) {
args = exttointerpreter[ext];
if (!args) {
elseCallback();