aljaz/goose
1
0
Fork 0
mirror of https://github.com/aljazceru/goose.git synced 2026-01-07 08:24:27 +01:00
Code Issues Packages Projects Releases Wiki Activity

feat: allowlist commands (#767)

Browse Source
This commit is contained in:
Bradley Axen
2025-01-24 18:14:06 -08:00
committed by GitHub
parent 56e5b0f144
commit dcfb76966f
1 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
ui/desktop/src/extensions.ts
View File

@@ -265,7 +265,17 @@ export async function addExtensionFromDeepLink(url: string, navigate: NavigateFu
throw new Error("Missing required 'cmd' parameter in the URL");
}
// Validate that the command is one of the allowed commands
const allowedCommands = ['npx', 'uvx', 'goosed'];
if (!allowedCommands.includes(cmd)) {
throw new Error(`Invalid command: ${cmd}. Only ${allowedCommands.join(', ')} are allowed.`);
}
// Check for security risk with npx -c command
const args = parsedUrl.searchParams.getAll('arg');
if (cmd === 'npx' && args.includes('-c')) {
throw new Error('Error: npx with -c argument can lead to code injection');
}
const envList = parsedUrl.searchParams.getAll('env');
const id = parsedUrl.searchParams.get('id');
const name = parsedUrl.searchParams.get('name');