Skip to content

Potential fix for code scanning alert no. 12: Uncontrolled command line #734

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tester2024 merged 2 commits into from
Sep 7, 2026
Merged

Potential fix for code scanning alert no. 12: Uncontrolled command line #734

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
950b95a
Potential fix for code scanning alert no. 12: Uncontrolled command line
tester2024 Sep 7, 2026
6e13b95
Potential fix for pull request finding 'CodeQL / Uncontrolled command…
mrzt721010 Sep 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 18 additions & 15 deletions web/app.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -236,7 +236,9 @@
method = data.get("method", "").strip().upper()
target = data.get("target", "").strip()

if method not in ALL_METHODS:
allowed_methods = {m: m for m in ALL_METHODS}
safe_method = allowed_methods.get(method)
if safe_method is None:
return jsonify({"success": False, "error": "Invalid method."}), 400

if not target:
Expand All @@ -258,36 +260,37 @@
duration = _safe_int(data.get("duration", 60), 60, 1, 86400)

start_py = str(BASE_DIR / "start.py")
cmd = [PYTHON_EXE, start_py, method, target]
safe_cmd = [PYTHON_EXE, start_py, safe_method, target]

if layer == "L7":
socks_type = _safe_int(data.get("socks_type", 0), 0, 0, 6)
if socks_type not in VALID_SOCKS_TYPES:
socks_type = 0
rpc = _safe_int(data.get("rpc", 10), 10, 1, 10000)
proxylist = Path(data.get("proxylist", "http.txt").strip() or "http.txt").name
if proxylist not in ALLOWED_LIST_FILES:
proxylist = "http.txt"
cmd.extend([str(socks_type), str(threads), proxylist, str(rpc), str(duration)])
proxylist_candidate = Path(data.get("proxylist", "http.txt").strip() or "http.txt").name
proxylist = proxylist_candidate if proxylist_candidate in ALLOWED_LIST_FILES else "http.txt"
safe_cmd.extend([str(socks_type), str(threads), proxylist, str(rpc), str(duration)])
else:
cmd.extend([str(threads), str(duration)])
safe_cmd.extend([str(threads), str(duration)])
if method in METHODS_AMP:
amp_file = Path(data.get("reflector", "").strip()).name
if amp_file in ALLOWED_LIST_FILES:
cmd.append(amp_file)
amp_candidate = Path(data.get("reflector", "").strip()).name
amp_file = amp_candidate if amp_candidate in ALLOWED_LIST_FILES else None
if amp_file is not None:
safe_cmd.append(amp_file)
else:
proxy_type = _safe_int(data.get("socks_type", 0), 0, 0, 6)
if proxy_type not in VALID_SOCKS_TYPES:
proxy_type = 0
proxy_file = Path(data.get("proxylist", "").strip()).name
if proxy_file in ALLOWED_LIST_FILES:
cmd.extend([str(proxy_type), proxy_file])
proxy_candidate = Path(data.get("proxylist", "").strip()).name
proxy_file = proxy_candidate if proxy_candidate in ALLOWED_LIST_FILES else None
if proxy_file is not None:
safe_cmd.extend([str(proxy_type), proxy_file])

task_id = str(uuid.uuid4())[:8]

try:
proc = subprocess.Popen(
cmd,
safe_cmd,
Comment thread
Copilot marked this conversation as resolved.
cwd=str(BASE_DIR),
stdout=subprocess.PIPE,
stderr=subprocess.STDOUT,
Expand All @@ -300,7 +303,7 @@
"id": task_id,
"pid": proc.pid,
"layer": layer,
"method": method,
"method": safe_method,
"target": target,
"threads": threads,
"duration": duration,
Expand Down
Loading