mtfyun/1panel
1
0 Fork 0
mirror of https://github.com/1Panel-dev/1Panel.git synced 2026-11-10 21:21:13 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: prevent tar option injection (#14335)

Browse Source
This commit is contained in:
蘭 authored and GitHub committed 2026-11-08 22:39:19 +08:00
1 parent 8ed1bf0eda
commit af919ed887
2 files changed
+3 -3
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

agent/utils/files/tar.go
+1 -1
View File
@@ -43,7 +43,7 @@ func (t TarArchiver) Compress(ctx context.Context, sourcePaths []string, dstFile
return err
}
baseDir := filepath.Dir(sourcePaths[0])
args := []string{t.getOptionStr("compress"), dstFile, "-C", baseDir}
args := []string{t.getOptionStr("compress"), dstFile, "-C", baseDir, "--"}
for _, sourcePath := range sourcePaths {
args = append(args, filepath.Base(sourcePath))
}
agent/utils/files/tar_gz.go
+2 -2
View File
@@ -55,9 +55,9 @@ func (t TarGzArchiver) Compress(ctx context.Context, sourcePaths []string, dstFi
aheadDir = "/"
}
if len(secret) != 0 {
err = runTarGzEncryptToFile(cmd.NewCommandMgr(cmd.WithContext(ctx)), tmpFile, secret, append([]string{"-C", aheadDir}, itemDirs...)...)
err = runTarGzEncryptToFile(cmd.NewCommandMgr(cmd.WithContext(ctx)), tmpFile, secret, append([]string{"-C", aheadDir, "--"}, itemDirs...)...)
} else {
err = runTarGzToFile(cmd.NewCommandMgr(cmd.WithContext(ctx)), tmpFile, append([]string{"-C", aheadDir}, itemDirs...)...)
err = runTarGzToFile(cmd.NewCommandMgr(cmd.WithContext(ctx)), tmpFile, append([]string{"-C", aheadDir, "--"}, itemDirs...)...)
}
if err != nil {
return err