mirror of
https://github.com/software-mansion/argent.git
synced 2026-09-14 19:27:14 +08:00
Ignacy Łątka
717fb376b4
`detectRunningApp(udid)` interpolated `params.device_id` directly into
two execSync template strings:
execSync(`xcrun simctl spawn ${udid} launchctl list`)
execSync(`xcrun simctl listapps ${udid} | plutil -convert json -o - -`)
A device_id like `x;touch /tmp/pwn;#` was parsed by /bin/sh as additional
commands, giving any caller (including a cross-origin browser POST, since
the tool-server has no auth and serves wildcard CORS) arbitrary command
execution as the user running the tool-server.
Switched both calls to execFileSync with array args, which never invokes
a shell. The piped `xcrun listapps | plutil` is now two stages with the
plist piped via stdin (input option) instead of through /bin/sh.