Multiple Injection Restriction Bypasses Fixed: Directory traversal, globbing, chaining commands via executables, nested Shell syntax, shell expansions#11

Merged

drdavella merged 14 commits intopixee:mainfrom

LucasFaudman:main

Mar 11, 2024

Commits on Feb 10, 2024

Fixed all command injection vulnerabilites present in previous implementation by properly handling globbing, chained commands via other binaries, directory traversal and missing of banned binaries …

Lucas Faudman
authored and
Lucas Faudman
committed

Commits on Feb 13, 2024

Correctly handle $IFS/${IFS} in commands. check_banned_executable can use precomputed abs_path_strings for .endswith check

Lucas Faudman
authored and
Lucas Faudman
committed

Commits on Feb 15, 2024

Tests now check err.value.args[0].startswith(<Expected Exception Message>) not == since my execptions have slighly different message format but the check is still the exact same

Lucas Faudman
authored and
Lucas Faudman
committed
Convert to Pytest. Add shell expansion tests, nested shell syntax test and FuzzDB tests

Lucas Faudman
authored and
Lucas Faudman
committed
Correctly handle all shell expansions. Correctly handled deeply nested shell syntax with recursive_shlex_split. Compatible with Python3.8

Lucas Faudman
authored and
Lucas Faudman
committed
Convert to Pytest. Add shell expansion tests, nested shell syntax test and FuzzDB tests

Lucas Faudman
authored and
Lucas Faudman
committed
Handle all shell redirection operators

Lucas Faudman
authored and
Lucas Faudman
committed

Commits on Feb 16, 2024

handle arithmetic expansion of bracket paramters and nested expansions

Lucas Faudman
authored and
Lucas Faudman
committed

Commits on Feb 23, 2024

- Complete Shell param/brace/sequence expansion for all ALLOWED_SHELL_EXPANSION_OPERATORS.

Lucas Faudman
authored and
Lucas Faudman
committed

Commits on Feb 27, 2024

Remove redundant rmtree, remove script* and add time to BANNED_COMMAND_CHAINING_EXECUTABLES

Lucas Faudman
authored and
Lucas Faudman
committed
- check() now uses Popen kwargs to determine the initial env state and if shell expansion is needed.

Lucas Faudman
authored and
Lucas Faudman
committed
Remove unused os.environ import left by mistake

Lucas Faudman
authored and
Lucas Faudman
committed

Commits on Mar 5, 2024

Add FuzzDB license.

Lucas Faudman
authored and
Lucas Faudman
committed
remove unnessary list conversion

Lucas Faudman
authored and
Lucas Faudman
committed