如何清理 Runtime.exec() 中使用的用户输入? [英] How to sanitize user input used in Runtime.exec()?

问题描述

我需要通过命令行调用自定义脚本，脚本需要很少的参数并在 Linux 机器上调用.当前版本容易出现各种shell注入，如何清理用户给出的参数?参数包括登录名和路径(Unix 或 Windows 路径)，用户应该能够输入任何可能的路径(路径指的是用户服务器上的远程路径).

I need to call a custom script via command line, the scripts takes few arguments and is called on Linux machine. Current version is prone to all kinds of shell injection, how to sanitize arguments given by user? Arguments include login and path (Unix or Windows path) and user should be able to type in any possible path (the path refers to remote path on user server).

现在的代码看起来像这样:

The code right now simply looks like this:

Process process = Runtime.getRuntime().exec("myscript " + login + " " + path);

推荐答案

来自 这个答案，使用 ProcessBuilder 代替:

From this answer, use ProcessBuilder instead:

ProcessBuilder pb = new ProcessBuilder("myscript", login, path);

这应该可以防止 shell 注入.

This should secure it against shell injection.

如果路径仅指您自己系统上的路径，则路径注入应该不是问题:

Path injection should not be an issue if path only refers to a path on their own system as you say:

路径指的是用户服务器上的远程路径

the path refers to remote path on user server

风险在于服务器是否以某种方式联系路径"，这从您的问题中不清楚.它是什么类型的路径?一个 URL 路径，一个 Samba 共享?

The risk is if the server contacts the "path" somehow, which is not clear from your question. What type of path is it? A URL path, a Samba share?

您可能需要针对服务器端请求进行保护伪造.这涉及验证用户输入以检查它是否指的是外部服务器，而不是您自己网络内部的服务器.

You may need to secure it against Server Side Request Forgery. This involves validating the user input to check it refers to an external server, and not one inside of your own network.

这篇关于如何清理 Runtime.exec() 中使用的用户输入?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！