cyberpresidentvanellope/Polaris
1
0
Fork 0
mirror of https://github.com/PolarisSS13/Polaris.git synced 2025-12-15 20:52:07 +00:00
Code Issues Packages Projects Releases Wiki Activity

Port's /vg/'s RCE prevention.

Browse Source
This commit is contained in:
Neerti
2018-03-09 00:32:16 -05:00
parent a3228cd0c5
commit 0a2bf1eb42
2 changed files with 24 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
code/modules/ext_scripts/python.dm
View File

@@ -1,9 +1,27 @@
// Ported from /vg/.
/proc/escape_shell_arg(var/arg)
// RCE prevention
// - Encloses arg in single quotes
// - Escapes single quotes
// Also escapes %, ! on windows
if(world.system_type == MS_WINDOWS)
arg = replacetext(arg, "^", "^^") // Escape char
arg = replacetext(arg, "%", "%%") // %PATH% -> %%PATH%%
arg = replacetext(arg, "!", "^!") // !PATH!, delayed variable expansion on Windows
arg = replacetext(arg, "\"", "^\"")
arg = "\"[arg]\""
else
arg = replacetext(arg, "\\", "\\\\'") // Escape char
arg = replacetext(arg, "'", "\\'") // No breaking out of the single quotes.
arg = "'[arg]'"
return arg
/proc/ext_python(var/script, var/args, var/scriptsprefix = 1)
if(scriptsprefix) script = "scripts/" + script
if(scriptsprefix)
script = "scripts/" + script
if(world.system_type == MS_WINDOWS)
script = replacetext(script, "/", "\\")
var/command = config.python_path + " " + script + " " + args
return shell(command)
return shell(command)