mirror of
https://github.com/2dust/v2rayN.git
synced 2026-04-16 12:35:46 +00:00
A GUI client for Windows and Linux, support Xray core and v2fly core and others
3ff2079a5d
Security improvements for process execution in ProcUtils. VULNERABILITY DETAILS: - Location: ServiceLib/Common/ProcUtils.cs:20-27, 58 - Type: CWE-78 (OS Command Injection) - Impact: Potential command injection via improper argument quoting - Risk: Double-quoting could break escaping and allow shell metacharacters SECURITY IMPROVEMENTS: 1. Prevent double-quoting: Check if strings are already quoted before adding quotes 2. Smart argument detection: Don't quote multi-argument strings (containing - or /) 3. Improved validation: Only quote single arguments with spaces 4. Added security comments documenting the quoting logic 5. Fixed RebootAsAdmin to use same safe quoting logic TECHNICAL CHANGES: - Check for existing quotes before calling AppendQuotes() - Detect multi-argument strings by checking for " -" and " /" patterns - Don't quote arguments that contain quotes (may be pre-formatted) - Extract exePath in RebootAsAdmin to apply same validation BEFORE (vulnerable): - Any string with spaces was blindly quoted - Already-quoted strings would be double-quoted: ""path"" (invalid) - Multi-argument strings treated as single arg: "arg1 arg2" (broken) AFTER (improved): - Only quote unquoted strings with spaces - Preserve existing quotes in strings - Detect and preserve multi-argument patterns - Consistent handling across both methods LIMITATIONS: - UseShellExecute = true is still used (required for URL/shell association handling) - For maximum security, callers should use whitelisting of allowed executables - Complex argument strings should be properly formatted by callers TESTING: - Handles paths like "C:\Program Files\app.exe" correctly - Preserves already-quoted paths: "\"C:\Program Files\app.exe\"" - Doesn't break multi-arg strings: "arg1 -flag value" - Works with both Windows (/) and Unix (-) style arguments References: - CWE-78: https://cwe.mitre.org/data/definitions/78.html - OWASP Command Injection: https://owasp.org/www-community/attacks/Command_Injection Note: This is a defense-in-depth measure. The primary risk mitigation is that most callers use application-controlled paths rather than user input. |
||
|---|---|---|
| .github | ||
| v2rayN | ||
| .editorconfig | ||
| .gitattributes | ||
| .gitignore | ||
| .gitmodules | ||
| BUG_REPORT.md | ||
| LICENSE | ||
| package-debian.sh | ||
| package-osx.sh | ||
| package-release-zip.sh | ||
| package-rhel.sh | ||
| README.md | ||
