fix: 解决命令注入waf被绕过的问题 (1Panel-dev#4131)

KaySar12 · Mar 8, 2024 · 1087f7e · 1087f7e
1 parent 268435d
commit 1087f7e
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/backend/utils/cmd/cmd.go b/backend/utils/cmd/cmd.go
@@ -177,7 +177,8 @@ func CheckIllegal(args ...string) bool {
 	for _, arg := range args {
 		if strings.Contains(arg, "&") || strings.Contains(arg, "|") || strings.Contains(arg, ";") ||
 			strings.Contains(arg, "$") || strings.Contains(arg, "'") || strings.Contains(arg, "`") ||
-			strings.Contains(arg, "(") || strings.Contains(arg, ")") || strings.Contains(arg, "\"") {
+			strings.Contains(arg, "(") || strings.Contains(arg, ")") || strings.Contains(arg, "\"") ||
+			strings.Contains(arg, "\n") || strings.Contains(arg, "\r") {
 			return true
 		}
 	}