Skip to content

Commit

Permalink
Merge pull request #2 from d3v53c/huntr/rce-01
Browse files Browse the repository at this point in the history
RCE fix: use execFile and pass commands as arguments
  • Loading branch information
JamieSlome authored Dec 17, 2020
2 parents a5f6e9e + 7e944e9 commit e5343b6
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion src/index.js
Original file line number Diff line number Diff line change
Expand Up @@ -725,7 +725,7 @@ f.echo = function (data, callback) {
f.echo.args = ['data', 'callback'];

f.setDate = function (date, callback) {
child_process.exec('date -s "' + date + '"', dateResponse);
child_process.execFile('date', ['-s', date], dateResponse)

function dateResponse(error, stdout, stderr) {
if (typeof callback != 'function') return;
Expand Down

0 comments on commit e5343b6

Please sign in to comment.