search

KAIST-IS521 / 2018s-onion-team2

0 stars 0 forks source link

Fix: command injection #74

Closed zanywhale closed 6 years ago

zanywhale commented 6 years ago

Issue #73 bug patch code Add new exp ' > < & | 

char* gpg::decBytestream(char* src, string* passphrase){
  string encData(src);
  string prefix_cmd("echo \'");
  string middle_cmd("\' | gpg --no-tty --batch --logger-fd 1 -d --passphrase \'");
  string suffix_cmd("\' 2>/dev/null");
  // Add new exp ', >, <, &
  std::regex exp ("[;|\$\(|\)|\'|\>|\<|\&|\||\`]");
   if(std::regex_search(*passphrase,exp )){
    cout << "Passphrase REGEX Fault" << endl;
    return NULL;
  }