Node.js 執(zhí)行命令

1.2.1 【必須】使用child_process執(zhí)行系統(tǒng)命令，應(yīng)限定或校驗(yàn)命令和參數(shù)的內(nèi)容

• 適用場(chǎng)景包括：child_process.exec, child_process.execSync, child_process.spawn, child_process.spawnSync, child_process.execFile, child_process.execFileSync

• 調(diào)用上述函數(shù)，應(yīng)首先考慮限定范圍，供用戶選擇。

• 使用child_process.exec或child_process.execSync時(shí)，如果可枚舉輸入的參數(shù)內(nèi)容或者格式，則應(yīng)限定白名單。如果無(wú)法枚舉命令或參數(shù)，則必須過(guò)濾或者轉(zhuǎn)義指定符號(hào)，包括：|;&$()><`!

• 使用child_process.spawn 或child_process.execFile時(shí)，應(yīng)校驗(yàn)傳入的命令和參數(shù)在可控列表內(nèi)。

const Router = require("express").Router();
const validator = require("validator");
const { exec } = require('child_process');


// bad：未限定或過(guò)濾，直接執(zhí)行命令
Router.get("/vul_cmd_inject", (req, res) => {
    const txt = req.query.txt || "echo 1";
    exec(txt, (err, stdout, stderr) => {
        if (err) { res.send({ err: 1 }) }
        res.send({stdout, stderr});
    });
});


// good：通過(guò)白名單，限定外部可執(zhí)行命令范圍
Router.get("/not_vul_cmd_inject", (req, res) => {
    const txt = req.query.txt || "echo 1";
  const phone = req.query.phone || "";
    const cmdList = {
        sendmsg: "./sendmsg "
    };
    if (txt in cmdList && validator.isMobilePhone(phone)) {
        exec(cmdList[txt] + phone, (err, stdout, stderr) => {
          if (err) { res.send({ err: 1 }) };
          res.send({stdout, stderr});
        });
    } else {
        res.send({
            err: 1,
            tips: `you can use '${Object.keys(cmdList)}'`,
        });
    }
});


// good：執(zhí)行命令前，過(guò)濾/轉(zhuǎn)義指定符號(hào)
Router.get("/not_vul_cmd_inject", (req, res) => {
    const txt = req.query.txt || "echo 1";
  let phone = req.query.phone || "";
    const cmdList = {
        sendmsg: "./sendmsg "
    };
    phone = phone.replace(/(\||;|&|\$\(|\(|\)|>|<|\`|!)/gi,"");
    if (txt in cmdList) {
        exec(cmdList[txt] + phone, (err, stdout, stderr) => {
          if (err) { res.send({ err: 1 }) };
          res.send({stdout, stderr});
        });
    } else {
        res.send({
            err: 1,
            tips: `you can use '${Object.keys(cmdList)}'`,
        });
    }
});

關(guān)聯(lián)漏洞：高風(fēng)險(xiǎn) - 任意命令執(zhí)行