mirror of
https://github.com/CHOMPstation/CHOMPstation.git
synced 2026-05-18 20:59:41 +01:00
AnonymousHybi
28 lines
964 B
Plaintext
28 lines
964 B
Plaintext
// Ported from /vg/.
|
|
/proc/escape_shell_arg(var/arg)
|
|
// RCE prevention
|
|
// - Encloses arg in single quotes
|
|
// - Escapes single quotes
|
|
// Also escapes %, ! on windows
|
|
if(world.system_type == MS_WINDOWS)
|
|
arg = replacetext(arg, "^", "^^") // Escape char
|
|
arg = replacetext(arg, "%", "%%") // %PATH% -> %%PATH%%
|
|
arg = replacetext(arg, "!", "^!") // !PATH!, delayed variable expansion on Windows
|
|
arg = replacetext(arg, "\"", "^\"")
|
|
arg = "\"[arg]\""
|
|
else
|
|
arg = replacetext(arg, "\\", "\\\\'") // Escape char
|
|
arg = replacetext(arg, "'", "\\'") // No breaking out of the single quotes.
|
|
arg = "'[arg]'"
|
|
return arg
|
|
|
|
/proc/ext_python(var/script, var/args, var/scriptsprefix = 1)
|
|
if(scriptsprefix) script = "scripts/" + script
|
|
if(world.system_type == MS_WINDOWS)
|
|
script = replacetext(script, "/", "\\")
|
|
|
|
var/command = config.python_path + " " + script + " " + args
|
|
log_debug("ext_python: Sending [command] to shell")
|
|
shell("[command]")
|
|
return
|