fix(security): bypass allowed cmds

[asdfzxcvbn]

using control operators, you can use disallowed commands. see screenshot below for example.

this fix simply creates a list of all known operators that can be used and checks the input for them.

[mhkarimi1383]

Hi,
Using a temp docker container (for each console request) witch has docker client cli that for running command is safer than doing this

[asdfzxcvbn]

Using a temp docker container (for each console request) witch has docker client cli that for running command is safer than doing this

yeah, maybe safer, but definitely not as performant. i doubt you can do any real damage with only 4 commands, anyway. blocking control operators is probably the best solution.

[louislam]

It looks like if any string contain this characters, it also throws the error.

But actually, since it is a bit powerful, I want to completely turn off this feature by default and use an env var to turn on/off this feature.

[asdfzxcvbn]

It looks like if any string contain this characters, it also throws the error.

yeah, thats what i had to do since spaces aren't required. for example, ls ;echo hi also works, so just checking every item in cmdParts wouldn't work.

But actually, since it is a bit powerful, I want to completely turn off this feature by default and use an env var to turn on/off this feature.

yep, that'd be even better!