github-featured/webmin--webmin
2
0
Fork 0
Code Issues Pull Requests Deployments Models Agent Notes Packages Projects Releases Wiki Activity

Fix to use quotemeta to prevent shell injection in Proc module

Browse Source
This commit is contained in:
Ilia Ross
2026-02-10 21:40:15 +02:00
parent 821548354d
commit e13123bed1
8 changed files with 56 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
proc/freebsd-lib.pl
+9 -2
View File
@@ -6,7 +6,13 @@ use IO::Handle;
sub list_processes
{
local($pcmd, $line, $i, %pidmap, @plist);
$pcmd = @_ ? "-p $_[0]" : "";
if (@_) {
$_[0] =~ /^\d+$/ || return ( );
$pcmd = "-p ".quotemeta($_[0]);
}
else {
$pcmd = "";
}
open(PS, "ps -axwwww -o pid,ppid,user,vsz,%cpu,time,nice,tty,ruser,rgid,pgid,lstart,lim,command $pcmd |");
for($i=0; $line=<PS>; $i++) {
chop($line);
@@ -37,7 +43,8 @@ return @plist;
sub renice_proc
{
return undef if (&is_readonly_mode());
local $out = &backquote_logged("renice $_[1] -p $_[0] 2>&1");
local $out = &backquote_logged("renice ".quotemeta($_[1])." -p ".
quotemeta($_[0])." 2>&1");
if ($?) { return $out; }
return undef;
}
proc/hpux-lib.pl
+6 -3
View File
@@ -4,8 +4,10 @@
sub list_processes
{
local($line, $i, $pcmd, $_, $tty, @plist);
local @want = grep { /^\d+$/ } @_;
return ( ) if (@_ && !@want);
foreach (@_) { $pcmd .= "-p $_"; }
foreach (@want) { $pcmd .= "-p ".quotemeta($_)." "; }
if (!$pcmd) { $pcmd = "-e"; }
open(PS, "ps -fl $pcmd |");
@@ -45,7 +47,8 @@ sub renice_proc
return undef if (&is_readonly_mode());
local($out, $nice);
$nice = $_[1] - 20;
local $out = &backquote_logged("renice -n $nice -p $_[0] 2>&1");
local $out = &backquote_logged("renice -n ".quotemeta($nice)." -p ".
quotemeta($_[0])." 2>&1");
if ($?) { return $out; }
return undef;
}
@@ -55,7 +58,7 @@ return undef;
sub find_mount_processes
{
local($out);
$out = `fuser -c $_[0]`;
$out = &backquote_command("fuser -c ".quotemeta($_[0]));
$out =~ s/[^0-9 ]//g;
$out =~ s/^\s+//g; $out =~ s/\s+$//g;
return split(/\s+/, $out);
proc/linux-lib.pl
+9 -5
View File
@@ -18,10 +18,12 @@ return $get_ps_version_cache;
sub list_processes
{
local($pcmd, $line, $i, %pidmap, @plist, $dummy, @w, $_);
local @want = grep { /^\d+$/ } @_;
return ( ) if (@_ && !@want);
local $ver = &get_ps_version();
if ($ver && $ver < 2) {
# Old version of ps
$pcmd = join(' ' , @_);
$pcmd = join(' ' , @want);
open(PS, "ps aulxhwwww $pcmd 2>/dev/nul |");
for($i=0; $line=<PS>; $i++) {
chop($line);
@@ -82,7 +84,7 @@ else {
# Skip process ID 0 or ps command
$i--; next;
}
if (@_ && &indexof($w[4], @_) < 0) {
if (@want && &indexof($w[4], @want) < 0) {
# Not interested in this PID
$i--; next;
}
@@ -128,7 +130,8 @@ return @plist;
sub renice_proc
{
return undef if (&is_readonly_mode());
local $out = &backquote_logged("renice $_[1] -p $_[0] 2>&1");
local $out = &backquote_logged("renice ".quotemeta($_[1])." -p ".
quotemeta($_[0])." 2>&1");
if ($?) { return $out; }
return undef;
}
@@ -402,9 +405,10 @@ sub open_process_trace
local $fh = time().$$;
local $sc;
if (@{$_[1]}) {
$sc = "-e trace=".join(",", @{$_[1]});
$sc = "-e trace=".join(",", map { quotemeta($_) } grep { $_ ne "" }
@{$_[1]});
}
local $tpid = open($fh, "strace -t -p $_[0] $sc 2>&1 |");
local $tpid = open($fh, "strace -t -p ".quotemeta($_[0])." $sc 2>&1 |");
$line = <$fh>;
return { 'pid' => $_[0],
'tpid' => $tpid,
proc/macos-lib.pl
+6 -3
View File
@@ -5,7 +5,9 @@ sub list_processes
{
local($pcmd, $line, $i, %pidmap, @plist);
if (@_) {
open(PS, "ps xlwwwwp $_[0] |");
$_[0] =~ /^\d+$/ || return ( );
my $pid = quotemeta($_[0]);
open(PS, "ps xlwwwwp $pid |");
}
else {
open(PS, "ps axlwwww |");
@@ -46,7 +48,7 @@ for($i=0; $line=<PS>; $i++) {
}
}
close(PS);
open(PS, "ps auxwwww $_[0] |");
open(PS, "ps auxwwww ".(@_ ? quotemeta($_[0]) : "")." |");
while($line = <PS>) {
chop($line);
$line =~ /^(\S+)\s+(\d+)\s+(\S+)\s+(\S+)/ || next;
@@ -63,7 +65,8 @@ return @plist;
sub renice_proc
{
return undef if (&is_readonly_mode());
local $out = &backquote_logged("renice $_[1] -p $_[0] 2>&1");
local $out = &backquote_logged("renice ".quotemeta($_[1])." -p ".
quotemeta($_[0])." 2>&1");
if ($?) { return $out; }
return undef;
}
proc/openbsd-lib.pl
+9 -2
View File
@@ -4,7 +4,13 @@
sub list_processes
{
local($pcmd, $line, $i, %pidmap, @plist);
$pcmd = @_ ? "-p $_[0]" : "";
if (@_) {
$_[0] =~ /^\d+$/ || return ( );
$pcmd = "-p ".quotemeta($_[0]);
}
else {
$pcmd = "";
}
open(PS, "ps -axwwww -o pid,ppid,user,vsz,%cpu,time,nice,tty,ruser,rgid,pgid,lstart,lim,command $pcmd |");
for($i=0; $line=<PS>; $i++) {
chop($line);
@@ -35,7 +41,8 @@ return @plist;
sub renice_proc
{
return undef if (&is_readonly_mode());
local $out = &backquote_logged("renice $_[1] -p $_[0] 2>&1");
local $out = &backquote_logged("renice ".quotemeta($_[1])." -p ".
quotemeta($_[0])." 2>&1");
if ($?) { return $out; }
return undef;
}
proc/osf-lib.pl
+6 -3
View File
@@ -5,7 +5,9 @@
sub list_processes
{
local($line, $dummy, @w, $i, $_, $pcmd, @plist);
foreach (@_) { $pcmd .= " -p $_"; }
local @want = grep { /^\d+$/ } @_;
return ( ) if (@_ && !@want);
foreach (@want) { $pcmd .= " -p ".quotemeta($_); }
if (!$pcmd) { $pcmd = " -e"; }
open(PS, "ps -o user,ruser,group,rgroup,pid,ppid,pgid,pcpu,vsz,nice,etime,time,tty,args $pcmd |");
$dummy = <PS>;
@@ -44,7 +46,7 @@ return @plist;
sub find_mount_processes
{
local($out);
$out = `fuser -c $_[0] 2>/dev/null`;
$out = &backquote_command("fuser -c ".quotemeta($_[0])." 2>/dev/null");
$out =~ s/^\s+//g; $out =~ s/\s+$//g;
return split(/\s+/, $out);
}
@@ -64,7 +66,8 @@ return split(/\s+/, $out);
sub renice_proc
{
return undef if (&is_readonly_mode());
local $out = &backquote_logged("renice $_[1] -p $_[0] 2>&1");
local $out = &backquote_logged("renice ".quotemeta($_[1])." -p ".
quotemeta($_[0])." 2>&1");
if ($?) { return $out; }
return undef;
}
proc/sysv-lib.pl
+9 -5
View File
@@ -9,7 +9,9 @@ $has_zone = $gconfig{'os_type'} eq 'solaris' && $gconfig{'os_version'} >= 10;
sub list_processes
{
local($line, $dummy, @w, $i, $_, $pcmd, @plist);
foreach (@_) { $pcmd .= " -p $_"; }
local @want = grep { /^\d+$/ } @_;
return ( ) if (@_ && !@want);
foreach (@want) { $pcmd .= " -p ".quotemeta($_); }
if (!$pcmd) { $pcmd = " -e"; }
$ENV{'COLUMNS'} = 10000; # needed on AIX
local @cols = ( "user","ruser","group","rgroup","pid","ppid","pgid","pcpu","vsz",
@@ -68,7 +70,7 @@ return @plist;
sub find_mount_processes
{
local($out);
$out = `fuser -c $_[0] 2>/dev/null`;
$out = &backquote_command("fuser -c ".quotemeta($_[0])." 2>/dev/null");
$out =~ s/^\s+//g; $out =~ s/\s+$//g;
return split(/\s+/, $out);
}
@@ -88,7 +90,8 @@ return split(/\s+/, $out);
sub renice_proc
{
return undef if (&is_readonly_mode());
local $out = &backquote_logged("renice $_[1] -p $_[0] 2>&1");
local $out = &backquote_logged("renice ".quotemeta($_[1])." -p ".
quotemeta($_[0])." 2>&1");
if ($?) { return $out; }
return undef;
}
@@ -129,9 +132,10 @@ sub open_process_trace
local $fh = time().$$;
local $sc;
if (@{$_[1]}) {
$sc = "-t ".join(",", @{$_[1]});
$sc = "-t ".join(",", map { quotemeta($_) } grep { $_ ne "" }
@{$_[1]});
}
local $tpid = open($fh, "truss $sc -i -p $_[0] 2>&1 |");
local $tpid = open($fh, "truss $sc -i -p ".quotemeta($_[0])." 2>&1 |");
$line = <$fh>;
return { 'pid' => $_[0],
'tpid' => $tpid,
proc/windows-lib.pl
+2 -1
View File
@@ -45,7 +45,8 @@ return @plist;
sub renice_proc
{
return undef if (&is_readonly_mode());
local $out = &backquote_logged("process -p $_[0] $_[1] 2>&1");
local $out = &backquote_logged("process -p ".quotemeta($_[0])." ".
quotemeta($_[1])." 2>&1");
if ($?) { return $out; }
return undef;
}