open-source/qinglong
1
0
Fork 0
mirror of https://github.com/whyour/qinglong.git synced 2026-08-13 12:23:29 +08:00
Code Issues Packages Projects Releases Wiki Activity

Address code review feedback: improve validation patterns and escaping

Browse Source 
Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>
This commit is contained in:
copilot-swe-agent[bot]
2026-02-08 15:27:29 +00:00
co-authored by whyour
parent 0a2d7b1597
commit d20e154f21
4 changed files with 9 additions and 147 deletions
Download Patch File Download Diff File Expand all files Collapse all files
back/validation/schedule.ts
+4 -4
View File
@@ -28,14 +28,14 @@ const validateShellSecurity = (value: any, helpers: any, fieldName: string): any
// Background process spawning with suspicious names
/nohup\s+["']?[^\s"']*\/\.\w+/,
// Redirect to dev null (hiding output) combined with background execution
/>.*\/dev\/null.*&/,
// Redirect to dev null combined with downloads (hiding malware output)
/(curl|wget|fetch)[^;]*>.*\/dev\/null.*&/i,
// Base64 decode patterns (often used to obfuscate malicious code)
/\b(base64|decode|eval)\s+/i,
// File execution from temp directory
/\b\/tmp\/[^\s]+/,
// Executable files in /tmp with chmod or execution
/\/tmp\/[^\s]+\s*(&&|;)\s*(chmod|\.\/)/ ,
];
for (const pattern of dangerousPatterns) {