Skip to content

Commit e17b80c

Browse files
ssongliussongliu
authoredJul 17, 2023
fix: 解决部分接口命令注入问题 (#1690)
1 parent 1d6f1b0 commit e17b80c

File tree

12 files changed

+58
-7
lines changed

12 files changed

+58
-7
lines changed
 

‎backend/app/service/container.go

+4
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ import (
1818
"github.com/1Panel-dev/1Panel/backend/buserr"
1919
"github.com/1Panel-dev/1Panel/backend/constant"
2020
"github.com/1Panel-dev/1Panel/backend/global"
21+
"github.com/1Panel-dev/1Panel/backend/utils/cmd"
2122
"github.com/1Panel-dev/1Panel/backend/utils/common"
2223
"github.com/1Panel-dev/1Panel/backend/utils/docker"
2324
"github.com/docker/docker/api/types"
@@ -552,6 +553,9 @@ func (u *ContainerService) ContainerLogClean(req dto.OperationWithName) error {
552553
}
553554

554555
func (u *ContainerService) ContainerLogs(wsConn *websocket.Conn, container, since, tail string, follow bool) error {
556+
if cmd.CheckIllegal(container, since, tail) {
557+
return buserr.New(constant.ErrCmdIllegal)
558+
}
555559
command := fmt.Sprintf("docker logs %s", container)
556560
if tail != "0" {
557561
command += " -n " + tail

‎backend/app/service/container_compose.go

+14
Original file line numberDiff line numberDiff line change
@@ -14,8 +14,10 @@ import (
1414

1515
"github.com/1Panel-dev/1Panel/backend/app/dto"
1616
"github.com/1Panel-dev/1Panel/backend/app/model"
17+
"github.com/1Panel-dev/1Panel/backend/buserr"
1718
"github.com/1Panel-dev/1Panel/backend/constant"
1819
"github.com/1Panel-dev/1Panel/backend/global"
20+
"github.com/1Panel-dev/1Panel/backend/utils/cmd"
1921
"github.com/1Panel-dev/1Panel/backend/utils/compose"
2022
"github.com/1Panel-dev/1Panel/backend/utils/docker"
2123
"github.com/docker/docker/api/types"
@@ -127,6 +129,9 @@ func (u *ContainerService) PageCompose(req dto.SearchWithPage) (int64, interface
127129
}
128130

129131
func (u *ContainerService) TestCompose(req dto.ComposeCreate) (bool, error) {
132+
if cmd.CheckIllegal(req.Path) {
133+
return false, buserr.New(constant.ErrCmdIllegal)
134+
}
130135
composeItem, _ := composeRepo.GetRecord(commonRepo.WithByName(req.Name))
131136
if composeItem.ID != 0 {
132137
return false, constant.ErrRecordExist
@@ -143,6 +148,9 @@ func (u *ContainerService) TestCompose(req dto.ComposeCreate) (bool, error) {
143148
}
144149

145150
func (u *ContainerService) CreateCompose(req dto.ComposeCreate) (string, error) {
151+
if cmd.CheckIllegal(req.Name, req.Path) {
152+
return "", buserr.New(constant.ErrCmdIllegal)
153+
}
146154
if err := u.loadPath(&req); err != nil {
147155
return "", err
148156
}
@@ -177,6 +185,9 @@ func (u *ContainerService) CreateCompose(req dto.ComposeCreate) (string, error)
177185
}
178186

179187
func (u *ContainerService) ComposeOperation(req dto.ComposeOperation) error {
188+
if cmd.CheckIllegal(req.Path, req.Operation) {
189+
return buserr.New(constant.ErrCmdIllegal)
190+
}
180191
if _, err := os.Stat(req.Path); err != nil {
181192
return fmt.Errorf("load file with path %s failed, %v", req.Path, err)
182193
}
@@ -195,6 +206,9 @@ func (u *ContainerService) ComposeOperation(req dto.ComposeOperation) error {
195206
}
196207

197208
func (u *ContainerService) ComposeUpdate(req dto.ComposeUpdate) error {
209+
if cmd.CheckIllegal(req.Name, req.Path) {
210+
return buserr.New(constant.ErrCmdIllegal)
211+
}
198212
if _, err := os.Stat(req.Path); err != nil {
199213
return fmt.Errorf("load file with path %s failed, %v", req.Path, err)
200214
}

‎backend/app/service/database_mysql.go

+12
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ import (
1717
"github.com/1Panel-dev/1Panel/backend/buserr"
1818
"github.com/1Panel-dev/1Panel/backend/constant"
1919
"github.com/1Panel-dev/1Panel/backend/global"
20+
"github.com/1Panel-dev/1Panel/backend/utils/cmd"
2021
"github.com/1Panel-dev/1Panel/backend/utils/common"
2122
"github.com/1Panel-dev/1Panel/backend/utils/compose"
2223
_ "github.com/go-sql-driver/mysql"
@@ -77,6 +78,10 @@ var formatMap = map[string]string{
7778
}
7879

7980
func (u *MysqlService) Create(ctx context.Context, req dto.MysqlDBCreate) (*model.DatabaseMysql, error) {
81+
if cmd.CheckIllegal(req.Name, req.Username, req.Password, req.Format, req.Permission) {
82+
return nil, buserr.New(constant.ErrCmdIllegal)
83+
}
84+
8085
if req.Username == "root" {
8186
return nil, errors.New("Cannot set root as user name")
8287
}
@@ -184,6 +189,10 @@ func (u *MysqlService) Delete(ctx context.Context, req dto.MysqlDBDelete) error
184189
}
185190

186191
func (u *MysqlService) ChangePassword(info dto.ChangeDBInfo) error {
192+
if cmd.CheckIllegal(info.Value) {
193+
return buserr.New(constant.ErrCmdIllegal)
194+
}
195+
187196
var (
188197
mysql model.DatabaseMysql
189198
err error
@@ -253,6 +262,9 @@ func (u *MysqlService) ChangePassword(info dto.ChangeDBInfo) error {
253262
}
254263

255264
func (u *MysqlService) ChangeAccess(info dto.ChangeDBInfo) error {
265+
if cmd.CheckIllegal(info.Value) {
266+
return buserr.New(constant.ErrCmdIllegal)
267+
}
256268
var (
257269
mysql model.DatabaseMysql
258270
err error

‎backend/app/service/firewall.go

-1
Original file line numberDiff line numberDiff line change
@@ -304,7 +304,6 @@ func OperateFirewallPort(oldPorts, newPorts []int) error {
304304
return err
305305
}
306306
for _, port := range newPorts {
307-
308307
if err := client.Port(fireClient.FireInfo{Port: strconv.Itoa(port), Protocol: "tcp", Strategy: "accept"}, "add"); err != nil {
309308
return err
310309
}

‎backend/app/service/image_repo.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,7 @@ func (u *ImageRepoService) List() ([]dto.ImageRepoOption, error) {
7979

8080
func (u *ImageRepoService) Create(req dto.ImageRepoCreate) error {
8181
if cmd.CheckIllegal(req.Username, req.Password, req.DownloadUrl) {
82-
return buserr.New(constant.ErrRepoConn)
82+
return buserr.New(constant.ErrCmdIllegal)
8383
}
8484
imageRepo, _ := imageRepoRepo.Get(commonRepo.WithByName(req.Name))
8585
if imageRepo.ID != 0 {
@@ -148,7 +148,7 @@ func (u *ImageRepoService) Update(req dto.ImageRepoUpdate) error {
148148
return errors.New("The default value cannot be deleted !")
149149
}
150150
if cmd.CheckIllegal(req.Username, req.Password, req.DownloadUrl) {
151-
return buserr.New(constant.ErrRepoConn)
151+
return buserr.New(constant.ErrCmdIllegal)
152152
}
153153
repo, err := imageRepoRepo.Get(commonRepo.WithByID(req.ID))
154154
if err != nil {

‎backend/app/service/ssh.go

+4
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ import (
1111
"time"
1212

1313
"github.com/1Panel-dev/1Panel/backend/app/dto"
14+
"github.com/1Panel-dev/1Panel/backend/buserr"
1415
"github.com/1Panel-dev/1Panel/backend/constant"
1516
"github.com/1Panel-dev/1Panel/backend/global"
1617
"github.com/1Panel-dev/1Panel/backend/utils/cmd"
@@ -146,6 +147,9 @@ func (u *SSHService) UpdateByFile(value string) error {
146147
}
147148

148149
func (u *SSHService) GenerateSSH(req dto.GenerateSSH) error {
150+
if cmd.CheckIllegal(req.EncryptionMode, req.Password) {
151+
return buserr.New(constant.ErrCmdIllegal)
152+
}
149153
currentUser, err := user.Current()
150154
if err != nil {
151155
return fmt.Errorf("load current user failed, err: %v", err)

‎backend/constant/errs.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@ var (
4242
ErrTypePasswordExpired = "ErrPasswordExpired"
4343
ErrNameIsExist = "ErrNameIsExist"
4444
ErrDemoEnvironment = "ErrDemoEnvironment"
45+
ErrCmdIllegal = "ErrCmdIllegal"
4546
)
4647

4748
// app
@@ -107,7 +108,6 @@ var (
107108
ErrInUsed = "ErrInUsed"
108109
ErrObjectInUsed = "ErrObjectInUsed"
109110
ErrPortRules = "ErrPortRules"
110-
ErrRepoConn = "ErrRepoConn"
111111
)
112112

113113
// runtime

‎backend/i18n/lang/en.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ ErrNotSupportType: "The system does not support the current type: {{ .detail }}"
1313
ErrNameIsExist: "Name is already exist"
1414
ErrDemoEnvironment: "Demo server, prohibit this operation!"
1515
ErrCmdTimeout: "Command execution timed out！"
16+
ErrCmdIllegal: "The command contains illegal characters. Please modify and try again!"
1617

1718
#app
1819
ErrPortInUsed: "{{ .detail }} port already in use"
@@ -83,7 +84,6 @@ ErrTypeOfRedis: "The recovery file type does not match the current persistence m
8384
#container
8485
ErrInUsed: "{{ .detail }} is in use and cannot be deleted"
8586
ErrObjectInUsed: "This object is in use and cannot be deleted"
86-
ErrRepoConn: "The repository information contains illegal characters"
8787
ErrPortRules: "The number of ports does not match, please re-enter!"
8888

8989
#runtime

‎backend/i18n/lang/zh-Hant.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ ErrNotSupportType: "系統暫不支持當前類型: {{ .detail }}"
1313
ErrNameIsExist: "名稱已存在"
1414
ErrDemoEnvironment: "演示伺服器，禁止此操作!"
1515
ErrCmdTimeout: "指令執行超時！"
16+
ErrCmdIllegal: "執行命令中存在不合法字符，請修改後重試！"
1617

1718
#app
1819
ErrPortInUsed: "{{ .detail }} 端口已被佔用！"
@@ -83,7 +84,6 @@ ErrTypeOfRedis: "恢復文件類型與當前持久化方式不符，請修改後
8384
#container
8485
ErrInUsed: "{{ .detail }} 正被使用，無法刪除"
8586
ErrObjectInUsed: "該對象正被使用，無法刪除"
86-
ErrRepoConn: "倉庫資訊中存在不合法的字符"
8787
ErrPortRules: "端口數目不匹配，請重新輸入！"
8888

8989
#runtime

‎backend/i18n/lang/zh.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ ErrNotSupportType: "系统暂不支持当前类型: {{ .detail }}"
1313
ErrNameIsExist: "名称已存在"
1414
ErrDemoEnvironment: "演示服务器，禁止此操作!"
1515
ErrCmdTimeout: "命令执行超时！"
16+
ErrCmdIllegal: "执行命令中存在不合法字符，请修改后重试！"
1617

1718
#app
1819
ErrPortInUsed: "{{ .detail }} 端口已被占用！"
@@ -83,7 +84,6 @@ ErrTypeOfRedis: "恢复文件类型与当前持久化方式不符，请修改后
8384
#container
8485
ErrInUsed: "{{ .detail }} 正被使用，无法删除"
8586
ErrObjectInUsed: "该对象正被使用，无法删除"
86-
ErrRepoConn: "仓库信息中存在不合法的字符"
8787
ErrPortRules: "端口数目不匹配，请重新输入！"
8888

8989
#runtime

‎backend/utils/firewall/client/firewalld.go

+9
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,8 @@ import (
44
"fmt"
55
"strings"
66

7+
"github.com/1Panel-dev/1Panel/backend/buserr"
8+
"github.com/1Panel-dev/1Panel/backend/constant"
79
"github.com/1Panel-dev/1Panel/backend/utils/cmd"
810
)
911

@@ -114,6 +116,10 @@ func (f *Firewall) ListAddress() ([]FireInfo, error) {
114116
}
115117

116118
func (f *Firewall) Port(port FireInfo, operation string) error {
119+
if cmd.CheckIllegal(operation, port.Protocol, port.Port) {
120+
return buserr.New(constant.ErrCmdIllegal)
121+
}
122+
117123
stdout, err := cmd.Execf("firewall-cmd --zone=public --%s-port=%s/%s --permanent", operation, port.Port, port.Protocol)
118124
if err != nil {
119125
return fmt.Errorf("%s port failed, err: %s", operation, stdout)
@@ -122,6 +128,9 @@ func (f *Firewall) Port(port FireInfo, operation string) error {
122128
}
123129

124130
func (f *Firewall) RichRules(rule FireInfo, operation string) error {
131+
if cmd.CheckIllegal(operation, rule.Address, rule.Protocol, rule.Port, rule.Strategy) {
132+
return buserr.New(constant.ErrCmdIllegal)
133+
}
125134
ruleStr := ""
126135
if strings.Contains(rule.Address, "-") {
127136
std, err := cmd.Execf("firewall-cmd --permanent --new-ipset=%s --type=hash:ip", rule.Address)

‎backend/utils/firewall/client/ufw.go

+9
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,8 @@ import (
44
"fmt"
55
"strings"
66

7+
"github.com/1Panel-dev/1Panel/backend/buserr"
8+
"github.com/1Panel-dev/1Panel/backend/constant"
79
"github.com/1Panel-dev/1Panel/backend/utils/cmd"
810
)
911

@@ -131,6 +133,9 @@ func (f *Ufw) Port(port FireInfo, operation string) error {
131133
default:
132134
return fmt.Errorf("unsupport strategy %s", port.Strategy)
133135
}
136+
if cmd.CheckIllegal(port.Protocol, port.Port) {
137+
return buserr.New(constant.ErrCmdIllegal)
138+
}
134139

135140
command := fmt.Sprintf("%s %s %s", f.CmdStr, port.Strategy, port.Port)
136141
if operation == "remove" {
@@ -156,6 +161,10 @@ func (f *Ufw) RichRules(rule FireInfo, operation string) error {
156161
return fmt.Errorf("unsupport strategy %s", rule.Strategy)
157162
}
158163

164+
if cmd.CheckIllegal(operation, rule.Protocol, rule.Address, rule.Port) {
165+
return buserr.New(constant.ErrCmdIllegal)
166+
}
167+
159168
ruleStr := fmt.Sprintf("%s %s ", f.CmdStr, rule.Strategy)
160169
if operation == "remove" {
161170
ruleStr = fmt.Sprintf("%s delete %s ", f.CmdStr, rule.Strategy)

0 commit comments

Comments
 (0)