sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-10-23 13:59:09 +02:00
Code Issues Packages Projects Releases Wiki Activity

[client] Reject leading hyphen in getent input to prevent flag injection (#6787)

Browse Source
This commit is contained in:
Viktor Liu
2026-07-17 09:28:33 +02:00
committed by GitHub
parent 62fc8d254e
commit 63d60ba490
2 changed files with 9 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
client/ssh/server/getent_unix.go
+6 -1
View File
@@ -69,7 +69,8 @@ func parseGetentPasswd(output string) (*user.User, string, error) {
// validateGetentInput checks that the input is safe to pass to getent or id.
// Allows POSIX usernames, numeric UIDs, and common NSS extensions
// (@ for Kerberos, $ for Samba, + for NIS compat).
// (@ for Kerberos, $ for Samba, + for NIS compat). A leading hyphen is
// rejected so the input can never be parsed as a command-line flag.
func validateGetentInput(input string) bool {
maxLen := 32
if runtime.GOOS == "linux" {
@@ -80,6 +81,10 @@ func validateGetentInput(input string) bool {
return false
}
if input[0] == '-' {
return false
}
for _, r := range input {
if isAllowedGetentChar(r) {
continue