open-source/qinglong
1
0
Fork 0
mirror of https://github.com/whyour/qinglong.git synced 2026-08-13 20:30:48 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fix security validation patterns to avoid false positives

Browse Source 
Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>
This commit is contained in:
copilot-swe-agent[bot]
2026-02-08 15:25:44 +00:00
co-authored by whyour
parent ac8090d937
commit 0a2d7b1597
3 changed files with 150 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
back/validation/schedule.ts
+10 -10
View File
@@ -7,7 +7,7 @@ import config from '../config';
/**
* Security validation function to detect potentially malicious shell code patterns
*/
const validateShellSecurity = (value: string, helpers: any, fieldName: string) => {
const validateShellSecurity = (value: any, helpers: any, fieldName: string): any => {
if (!value) return value;
// Define dangerous patterns that should be blocked
@@ -22,20 +22,20 @@ const validateShellSecurity = (value: string, helpers: any, fieldName: string) =
// Suspicious domains or external URLs
/https?:\/\/[^\s]+/i,
// Hidden files starting with dot (common in malware)
/\s*\.\w+\s*$/,
// Hidden executable files (files starting with . in a path context)
/\/\.\w+(\s|$|;|&|\||>)/,
// Background process spawning with suspicious names
/nohup\s+[^\s]*\.\w+/,
/nohup\s+["']?[^\s"']*\/\.\w+/,
// Redirect to dev null (hiding output)
// Redirect to dev null (hiding output) combined with background execution
/>.*\/dev\/null.*&/,
// Base64 decode patterns (often used to obfuscate malicious code)
/\b(base64|decode|eval)\s+/i,
// File execution from temp or hidden directories
/\/(tmp|\.)\//,
// File execution from temp directory
/\b\/tmp\/[^\s]+/,
];
for (const pattern of dangerousPatterns) {
@@ -83,7 +83,7 @@ export const scheduleSchema = Joi.string()
export const commonCronSchema = {
name: Joi.string().optional(),
command: Joi.string().required().custom((value, helpers) => {
command: Joi.string().required().custom((value: any, helpers: any) => {
return validateShellSecurity(value, helpers, 'command');
}).messages({
'string.unsafe': '命令包含潜在危险的模式，已被安全系统拦截',
@@ -92,12 +92,12 @@ export const commonCronSchema = {
labels: Joi.array().optional(),
sub_id: Joi.number().optional().allow(null),
extra_schedules: Joi.array().optional().allow(null),
task_before: Joi.string().optional().allow('').allow(null).custom((value, helpers) => {
task_before: Joi.string().optional().allow('').allow(null).custom((value: any, helpers: any) => {
return validateShellSecurity(value, helpers, 'task_before');
}).messages({
'string.unsafe': '前置命令包含潜在危险的模式，已被安全系统拦截',
}),
task_after: Joi.string().optional().allow('').allow(null).custom((value, helpers) => {
task_after: Joi.string().optional().allow('').allow(null).custom((value: any, helpers: any) => {
return validateShellSecurity(value, helpers, 'task_after');
}).messages({
'string.unsafe': '后置命令包含潜在危险的模式，已被安全系统拦截',