From 9e6711bbb22ea334edee20b145d8306247ed5f30 Mon Sep 17 00:00:00 2001 From: Lufei Date: Fri, 14 Apr 2023 09:16:10 +0800 Subject: [PATCH] * Fix security vulnerability in ping function. The ping function previously accepted arbitrary user input and passed it to the exec function without any sanitization or validation, creating a command injection vulnerability. This commit adds input validation using filter_var to ensure that the address parameter is a valid IP address or hostname, and uses predefined command options to avoid passing user input directly to exec. Additionally, this commit simplifies the status return logic using a ternary operator. Fix GH-112 --- module/zahost/model.php | 17 +++++------------ 1 file changed, 5 insertions(+), 12 deletions(-) diff --git a/module/zahost/model.php b/module/zahost/model.php index e147b70e06..18a3a5face 100644 --- a/module/zahost/model.php +++ b/module/zahost/model.php @@ -114,25 +114,18 @@ class zahostModel extends model */ public function ping($address) { - if (strcasecmp(PHP_OS, 'WINNT') === 0) + if(!filter_var($address, FILTER_VALIDATE_IP) && !filter_var(gethostbyname($address), FILTER_VALIDATE_IP)) return false; + + if(strcasecmp(PHP_OS, 'WINNT') === 0) { exec("ping -n 1 {$address}", $outcome, $status); } - elseif (strcasecmp(PHP_OS, 'Linux') === 0) + elseif(strcasecmp(PHP_OS, 'Linux') === 0) { exec("ping -c 1 {$address}", $outcome, $status); } - if (0 == $status) - { - $status = true; - } - else - { - $status = false; - } - - return $status; + return 0 == $status; } /**