Don't die on strange chars (#5415)
Co-authored-by: Douwe Osinga <douwe@squareup.com>
This commit is contained in:
@@ -5,24 +5,6 @@ import Electron from 'electron';
|
||||
import log from './logger';
|
||||
|
||||
export const getBinaryPath = (app: Electron.App, binaryName: string): string => {
|
||||
// Security validation: Ensure binaryName doesn't contain suspicious characters
|
||||
if (
|
||||
!binaryName ||
|
||||
typeof binaryName !== 'string' ||
|
||||
binaryName.includes('..') ||
|
||||
binaryName.includes('/') ||
|
||||
binaryName.includes('\\') ||
|
||||
binaryName.includes(';') ||
|
||||
binaryName.includes('|') ||
|
||||
binaryName.includes('&') ||
|
||||
binaryName.includes('`') ||
|
||||
binaryName.includes('$') ||
|
||||
binaryName.length > 50
|
||||
) {
|
||||
// Reasonable length limit
|
||||
throw new Error(`Invalid binary name: ${binaryName}`);
|
||||
}
|
||||
|
||||
// On Windows, rely on PATH we just patched in ensureWinShims for command-line tools
|
||||
// but use explicit resources/bin path for goosed.exe
|
||||
if (process.platform === 'win32') {
|
||||
|
||||
Reference in New Issue
Block a user