fanbinit/rhymix
1
0
Fork 0
mirror of https://github.com/Lastorder-DC/rhymix.git synced 2026-04-02 01:52:10 +09:00
Code Issues Projects Releases Packages Wiki Activity

Add 'command' type to R\F\Security::sanitize()

Browse source
This commit is contained in:
Kijin Sung 2026-03-31 21:02:33 +09:00
parent ae44685306
commit b1f84365a5
2 changed files with 18 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

6
common/framework/Security.php
View file

@ -44,6 +44,12 @@ class Security
$sanitizer = new \enshrined\svgSanitize\Sanitizer(); $sanitizer = new \enshrined\svgSanitize\Sanitizer();
return strval($sanitizer->sanitize($input)); return strval($sanitizer->sanitize($input));
// Clean up a path to prevent argument injection.
case 'command':
if (!utf8_check($input)) return false;
if (\RX_WINDOWS || preg_match('![^a-z0-9/._-]!', $input)) return escapeshellarg($input);
return strval($input);
// Unknown filters. // Unknown filters.
default: default:
throw new Exception('Unknown filter type for sanitize: ' . $type); throw new Exception('Unknown filter type for sanitize: ' . $type);

11
tests/unit/framework/SecurityTest.php
View file

@ -25,6 +25,17 @@ class SecurityTest extends \Codeception\Test\Unit
$source = '<svg><rect></rect><script></script></svg>'; $source = '<svg><rect></rect><script></script></svg>';
$target = '<?xml version="1.0" encoding="UTF-8"?>' . "\n<svg>\n <rect></rect>\n</svg>\n"; $target = '<?xml version="1.0" encoding="UTF-8"?>' . "\n<svg>\n <rect></rect>\n</svg>\n";
$this->assertEquals($target, Rhymix\Framework\Security::sanitize($source, 'svg')); $this->assertEquals($target, Rhymix\Framework\Security::sanitize($source, 'svg'));
// Command
if (!\RX_WINDOWS)
{
$source = '/usr/bin/ffmpeg';
$target = '/usr/bin/ffmpeg';
$this->assertEquals($target, Rhymix\Framework\Security::sanitize($source, 'command'));
$source = '/usr/bin/path with space/ffmpeg';
$target = '\'/usr/bin/path with space/ffmpeg\'';
$this->assertEquals($target, Rhymix\Framework\Security::sanitize($source, 'command'));
}
} }
public function testEncryption() public function testEncryption()