diff options
author | vkalintiris <vasilis@netdata.cloud> | 2022-11-29 17:26:35 +0200 |
---|---|---|
committer | GitHub <noreply@github.com> | 2022-11-29 17:26:35 +0200 |
commit | 4de2ce54d59a4128425f8dde5924eed4fc6dad97 (patch) | |
tree | 698f01c9f404468887d4ae4ff797c3cef8c7ce21 /libnetdata/inlined.h | |
parent | 462988dac901e95e765cd6be2dc24a5c33595526 (diff) |
Sanitize command arguments. (#14064)
* Sanitize bash arguments.
Remove leading dashes and escape single quotes in command arguments.
* Quote expanded variable in test
Diffstat (limited to 'libnetdata/inlined.h')
-rw-r--r-- | libnetdata/inlined.h | 36 |
1 files changed, 36 insertions, 0 deletions
diff --git a/libnetdata/inlined.h b/libnetdata/inlined.h index ab09e64dec..aa7f3c2137 100644 --- a/libnetdata/inlined.h +++ b/libnetdata/inlined.h @@ -181,6 +181,42 @@ static inline void sanitize_json_string(char *dst, const char *src, size_t dst_s *dst = '\0'; } +static inline bool sanitize_command_argument_string(char *dst, const char *src, size_t dst_size) { + // skip leading dashes + while (src[0] == '-') + src++; + + // escape single quotes + while (src[0] != '\0') { + if (src[0] == '\'') { + if (dst_size < 4) + return false; + + dst[0] = '\''; dst[1] = '\\'; dst[2] = '\''; dst[3] = '\''; + + dst += 4; + dst_size -= 4; + } else { + if (dst_size < 1) + return false; + + dst[0] = src[0]; + + dst += 1; + dst_size -= 1; + } + + src++; + } + + // make sure we have space to terminate the string + if (dst_size == 0) + return false; + *dst = '\0'; + + return true; +} + static inline int read_file(const char *filename, char *buffer, size_t size) { if(unlikely(!size)) return 3; |