Don't die on strange chars (#5415)

Co-authored-by: Douwe Osinga <douwe@squareup.com>
This commit is contained in:
Douwe Osinga
2025-10-28 20:08:15 -04:00
committed by GitHub
parent 6b6b71f3b4
commit 5e0b074a98
2 changed files with 2 additions and 72 deletions
-18
View File
@@ -5,24 +5,6 @@ import Electron from 'electron';
import log from './logger';
export const getBinaryPath = (app: Electron.App, binaryName: string): string => {
// Security validation: Ensure binaryName doesn't contain suspicious characters
if (
!binaryName ||
typeof binaryName !== 'string' ||
binaryName.includes('..') ||
binaryName.includes('/') ||
binaryName.includes('\\') ||
binaryName.includes(';') ||
binaryName.includes('|') ||
binaryName.includes('&') ||
binaryName.includes('`') ||
binaryName.includes('$') ||
binaryName.length > 50
) {
// Reasonable length limit
throw new Error(`Invalid binary name: ${binaryName}`);
}
// On Windows, rely on PATH we just patched in ensureWinShims for command-line tools
// but use explicit resources/bin path for goosed.exe
if (process.platform === 'win32') {