55 lines
1.8 KiB
Diff
55 lines
1.8 KiB
Diff
From 64c18e3e654b55e3414894295127337705217139 Mon Sep 17 00:00:00 2001
|
||
From: toufik-airane <toufik.airane@gmail.com>
|
||
Date: Fri, 12 Jun 2020 21:06:44 +0200
|
||
Subject: [PATCH] Fix OS Command Injection on Jison
|
||
|
||
Fix OS Command Injection on Jison for huntr.dev.
|
||
https://www.huntr.dev/app/bounties/open/1-npm-jison
|
||
---
|
||
ports/csharp/Jison/Jison/csharp.js | 4 ++--
|
||
ports/php/php.js | 4 ++--
|
||
2 files changed, 4 insertions(+), 4 deletions(-)
|
||
|
||
diff --git a/ports/csharp/Jison/Jison/csharp.js b/ports/csharp/Jison/Jison/csharp.js
|
||
index 76c5d8ad..fdcd7b48 100644
|
||
--- a/ports/csharp/Jison/Jison/csharp.js
|
||
+++ b/ports/csharp/Jison/Jison/csharp.js
|
||
@@ -1,6 +1,6 @@
|
||
var fs = require('fs'),
|
||
util = require('util'),
|
||
- exec = require('child_process').exec,
|
||
+ execFile = require('child_process').execFile,
|
||
path = require('path');
|
||
|
||
GLOBAL.convertToSyntax = function (types, body) {
|
||
@@ -16,7 +16,7 @@ function puts(error, stdout, stderr) {
|
||
|
||
console.log("Executing: " + "jison " + process.argv[2]);
|
||
|
||
-exec("jison " + process.argv[2], function (error) {
|
||
+execFile("jison ", [process.argv[2]], function (error) {
|
||
if (error) {
|
||
console.log(error);
|
||
return;
|
||
diff --git a/ports/php/php.js b/ports/php/php.js
|
||
index 5e9f8425..e9b48499 100644
|
||
--- a/ports/php/php.js
|
||
+++ b/ports/php/php.js
|
||
@@ -1,6 +1,6 @@
|
||
var fs = require('fs'),
|
||
util = require('util'),
|
||
- exec = require('child_process').exec,
|
||
+ execFile = require('child_process').execFile,
|
||
path = require('path');
|
||
|
||
GLOBAL.convertToSyntax = function (types, body) {
|
||
@@ -16,7 +16,7 @@ function puts(error, stdout, stderr) {
|
||
|
||
console.log("Executing: " + "jison " + process.argv[2]);
|
||
|
||
-exec("jison " + process.argv[2], function (error) {
|
||
+execFile("jison ", [process.argv[2]], function (error) {
|
||
if (error) {
|
||
console.log(error);
|
||
return;
|