@aikidosec/firewall
Version:
Zen by Aikido is an embedded Application Firewall that autonomously protects Node.js apps against common and critical attacks, provides rate limiting, detects malicious traffic (including bots), and more.
32 lines (31 loc) • 1.45 kB
JavaScript
;
Object.defineProperty(exports, "__esModule", { value: true });
exports.isSafelyEncapsulated = isSafelyEncapsulated;
const getCurrentAndNextSegments_1 = require("../../helpers/getCurrentAndNextSegments");
const escapeChars = ['"', "'"];
const dangerousCharsInsideDoubleQuotes = ["$", "`", "\\", "!"];
function isSafelyEncapsulated(command, userInput) {
return (0, getCurrentAndNextSegments_1.getCurrentAndNextSegments)(command.split(userInput)).every(({ currentSegment, nextSegment }) => {
const charBeforeUserInput = currentSegment.slice(-1);
const charAfterUserInput = nextSegment.slice(0, 1);
const isEscapeChar = escapeChars.find((char) => char === charBeforeUserInput);
if (!isEscapeChar) {
return false;
}
if (charBeforeUserInput !== charAfterUserInput) {
return false;
}
if (userInput.includes(charBeforeUserInput)) {
return false;
}
// There are no dangerous characters inside single quotes
// You can use certain characters inside double quotes
// https://www.gnu.org/software/bash/manual/html_node/Single-Quotes.html
// https://www.gnu.org/software/bash/manual/html_node/Double-Quotes.html
if (isEscapeChar === '"' &&
dangerousCharsInsideDoubleQuotes.some((char) => userInput.includes(char))) {
return false;
}
return true;
});
}