From bfedfebfab032e6f4d5a369c8a2f947c5d0c5286 Mon Sep 17 00:00:00 2001
From: timothycarambat <rambat1010@gmail.com>
Date: Fri, 29 Mar 2024 13:03:05 -0700
Subject: [PATCH] security: force sanitize env string set by user
---
server/utils/helpers/updateENV.js | 14 +++++++++++---
1 file changed, 11 insertions(+), 3 deletions(-)
diff --git a/server/utils/helpers/updateENV.js b/server/utils/helpers/updateENV.js
index 29fa210ef..6e0e5daa6 100644
--- a/server/utils/helpers/updateENV.js
+++ b/server/utils/helpers/updateENV.js
@@ -564,6 +564,16 @@ async function dumpENV() {
"DISABLE_TELEMETRY",
];
+ // Simple sanitization of each value to prevent ENV injection via newline or quote escaping.
+ function sanitizeValue(value) {
+ const offendingChars =
+ /[\n\r\t\v\f\u0085\u00a0\u1680\u180e\u2000-\u200a\u2028\u2029\u202f\u205f\u3000"'`#]/;
+ const firstOffendingCharIndex = value.search(offendingChars);
+ if (firstOffendingCharIndex === -1) return value;
+
+ return value.substring(0, firstOffendingCharIndex);
+ }
+
for (const key of protectedKeys) {
const envValue = process.env?.[key] || null;
if (!envValue) continue;
@@ -572,9 +582,7 @@ async function dumpENV() {
var envResult = `# Auto-dump ENV from system call on ${new Date().toTimeString()}\n`;
envResult += Object.entries(frozenEnvs)
- .map(([key, value]) => {
- return `${key}='${value}'`;
- })
+ .map(([key, value]) => `${key}='${sanitizeValue(value)}'`)
.join("\n");
const envPath = path.join(__dirname, "../../.env");
--
GitLab