Merge branch 'develop' into 'master'

Fix vulnerabilities in scripts See merge request ADAS-Private/HEAppE/ClusterSetup!27
It4innovations · Sep 12, 2022 · a350307 · a350307
2 parents 3f4903e + be12544
commit a350307
Show file tree

Hide file tree

Showing 2 changed files with 28 additions and 10 deletions.
diff --git a/HPC/.key_scripts/remote-cmd3.sh b/HPC/.key_scripts/remote-cmd3.sh
@@ -5,17 +5,26 @@ baseprefixpath="TODO"
 basepath="${baseprefixpath}/${1}"
 
 echo "$(date) ($SSH_CLIENT): $cmd" >> "$sshcmdlog"
-echo "$cmd" | grep -E '\.{2}|\&|\|' > /dev/null && echo "Forbidden command (regex): $cmd" >> "$sshcmdlog" && exit
+echo "$cmd" | grep -E '\.{2}|\&|;|\|' > /dev/null && echo "Forbidden command (regex): $cmd" >> "$sshcmdlog" && exit
 echo "$cmd" | grep -F -v "${basepath}" > /dev/null && echo "Forbidden path: $cmd" >> "$sshcmdlog" && exit
 
-case "$cmd" in
-   scp*|ls*|mkdir*)
-        eval "$cmd"
+case "${cmd%% *}" in
+  ls)
+        ls ${cmd#*ls}
+        ;;
+  scp)
+        scp ${cmd#*scp}
+        ;;
+  mkdir)
+        mkdir ${cmd#*mkdir}
+        ;;
+  rsync)
+        rsync ${cmd#*rsync}
         ;;
   "")
         echo "Empty command." >> "$sshcmdlog"
         ;;
   *)
-        echo "Forbidden command: $cmd" >> "$sshcmdlog"
+        echo "Forbidden command: $cmd"  >> "$sshcmdlog"
         ;;
 esac
diff --git a/LocalHPC/.key_scripts/remote-cmd3.sh b/LocalHPC/.key_scripts/remote-cmd3.sh
@@ -5,17 +5,26 @@ baseprefixpath="TODO"
 basepath="${baseprefixpath}/${1}"
 
 echo "$(date) ($SSH_CLIENT): $cmd" >> "$sshcmdlog"
-echo "$cmd" | grep -E '\.{2}|\&|\|' > /dev/null && echo "Forbidden command (regex): $cmd" >> "$sshcmdlog" && exit
+echo "$cmd" | grep -E '\.{2}|\&|;|\|' > /dev/null && echo "Forbidden command (regex): $cmd" >> "$sshcmdlog" && exit
 echo "$cmd" | grep -F -v "${basepath}" > /dev/null && echo "Forbidden path: $cmd" >> "$sshcmdlog" && exit
 
-case "$cmd" in
-   scp*|ls*|mkdir*)
-        eval "$cmd"
+case "${cmd%% *}" in
+  ls)
+        ls ${cmd#*ls}
+        ;;
+  scp)
+        scp ${cmd#*scp}
+        ;;
+  mkdir)
+        mkdir ${cmd#*mkdir}
+        ;;
+  rsync)
+        rsync ${cmd#*rsync}
         ;;
   "")
         echo "Empty command." >> "$sshcmdlog"
         ;;
   *)
-        echo "Forbidden command: $cmd" >> "$sshcmdlog"
+        echo "Forbidden command: $cmd"  >> "$sshcmdlog"
         ;;
 esac