LukeMackin/Yuzu-GCA
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: exec命令正则放宽—允许全部ASCII可打印字符(引号/管道等)

Browse Source
This commit is contained in:
LukeMackin
2026-07-22 20:55:57 +08:00
parent cd62fd8fe4
commit 09457ed730
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
packages/server/src/tools.ts
View File

@@ -55,7 +55,7 @@ export async function file_move(args: { from: string; to: string }): Promise<any
// ── C-008: exec ───────────────────────────────────────────── // ── C-008: exec ─────────────────────────────────────────────
function sanitizeCommand(cmd: string): string { function sanitizeCommand(cmd: string): string {
// Allow: alphanumeric, dash, slash, dot, colon, underscore, space, equals, comma // Allow: alphanumeric, dash, slash, dot, colon, underscore, space, equals, comma
if (/[^a-zA-Z0-9_./\-: =,]/.test(cmd)) throw new Error(`Dangerous chars: ${cmd.slice(0,50)}`); if (/[^\x20-\x7E]/.test(cmd)) throw new Error(`Unsafe chars: ${cmd.slice(0,50)}`);
return cmd; return cmd;
} }