New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

nako3editのファイルの扱いの問題 #1347

Closed

kujirahand opened this issue Oct 7, 2022 · 1 comment

Owner

kujirahand commented Oct 7, 2022 •

edited

Loading

appkeyが短かったため総当たりでキーが取得される可能性があった
appkeyが取得された場合、nako3editにおいてファイル名経由で任意のコマンドを実行される問題があった。
- (例) http://localhost:8888/html/edit.html?file=`xeyes`.nako&appkey=K8078c3
以下コード中のdecodeURIComponentに不正な値が渡ることでサーバ機能が強制終了する問題があった
- (例) http://localhost:8888/html/edit.html?file=%

kujirahand added a commit that referenced this issue


          nako3editのファイル名におけるエラーを修正 #1347

4edd1ac

kujirahand added a commit that referenced this issue


          nako3editのapikeyを長くし、ファイルの扱いを厳格化 #1347

7df8162

Owner Author

kujirahand commented Oct 7, 2022

修正済みです。

kujirahand closed this as completed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment