Skip to content

Commit

Permalink
Escape commands passed to run and execute
Browse files Browse the repository at this point in the history
Each element in commands should be treated as a single argument so
we should escape it as an argument to prevent anything from
breakint out to execute anything else.
  • Loading branch information
stnguyen90 committed May 10, 2024
1 parent b5eaf86 commit 450018e
Showing 1 changed file with 2 additions and 6 deletions.
8 changes: 2 additions & 6 deletions src/Orchestration/Adapter/DockerCLI.php
Original file line number Diff line number Diff line change
Expand Up @@ -312,9 +312,7 @@ public function run(string $image,
$output = '';

foreach ($command as $key => $value) {
if (str_contains($value, ' ')) {
$command[$key] = "'".$value."'";
}
$command[$key] = \escapeshellarg($command[$key]);
}

$labelString = '';
Expand Down Expand Up @@ -389,9 +387,7 @@ public function execute(
int $timeout = -1
): bool {
foreach ($command as $key => $value) {
if (str_contains($value, ' ')) {
$command[$key] = "'".$value."'";
}
$command[$key] = \escapeshellarg($command[$key]);
}

$parsedVariables = [];
Expand Down

0 comments on commit 450018e

Please sign in to comment.