From bd501a073633c2f5918c77fa3c865aa198c4feee Mon Sep 17 00:00:00 2001 From: kiddin9 <48883331+kiddin9@users.noreply.github.com> Date: Thu, 8 Oct 2026 01:03:22 +0800 Subject: [PATCH] Update dockerman.patch --- .github/diy/patches/dockerman.patch | 19 ------------------- 1 file changed, 19 deletions(-) diff --git a/.github/diy/patches/dockerman.patch b/.github/diy/patches/dockerman.patch index e5892a822..8e68dc8dd 100644 --- a/.github/diy/patches/dockerman.patch +++ b/.github/diy/patches/dockerman.patch @@ -451,22 +451,3 @@ } return { - ---- a/luci-app-dockerman/root/usr/share/rpcd/ucode/docker_rpc.uc -+++ b/luci-app-dockerman/root/usr/share/rpcd/ucode/docker_rpc.uc -@@ -316,6 +316,15 @@ function run_ttyd(request) { - return { error: 'Container ID is required' }; - } - -+ // Strictly validate all user-supplied values before they are interpolated -+ // into a shell command string to prevent command injection. -+ if (!match(id, /^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/) || -+ !match(`${port}`, /^[0-9]{1,5}$/) || int(port) < 1 || int(port) > 65535 || -+ (uid && !match(`${uid}`, /^[a-zA-Z0-9_-]+$/)) || -+ !match(cmd, /^[a-zA-Z0-9_\/.\- ]+$/)) { -+ return { error: 'Invalid parameter supplied' }; -+ } -+ - let ttyd_cmd = `ttyd -q -d 2 --once --writable -p ${port} docker`; - const sock_addr = ds.get_socket_dest(); -