YunoHost/SSOwat
1
0
Fork 0
mirror of https://github.com/YunoHost/SSOwat.git synced 2024-09-03 20:06:27 +02:00
Code Issues Projects Releases Packages Wiki Activity

[fix] be paranoid and prevent shell injections here also while input is supposed to be safe

Browse source
This commit is contained in:
Laurent Peuch 2017-08-18 02:35:08 +02:00
parent c8c7fe7fc7
commit d440d06ae7
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
helpers.lua
View file

@ -81,7 +81,7 @@ function hmac_sha512(key, message)
-- this is really dirty and probably leak the key and the message in the process list -- this is really dirty and probably leak the key and the message in the process list
-- but if someone got there I guess we really have other problems so this is acceptable -- but if someone got there I guess we really have other problems so this is acceptable
-- and also this is way better than the previous situation -- and also this is way better than the previous situation
local pipe = io.popen("echo -n '" ..message.. "' | openssl sha512 -hmac '" ..key.. "'") local pipe = io.popen("echo -n '" ..message:gsub("'", "'\\''").. "' | openssl sha512 -hmac '" ..key:gsub("'", "'\\''").. "'")
-- openssl returns something like this: -- openssl returns something like this:
-- root@yunohost:~# echo -n "qsd" | openssl sha512 -hmac "key" -- root@yunohost:~# echo -n "qsd" | openssl sha512 -hmac "key"