NeoAnd/evolution-api
1
0
Fork 0
mirror of https://github.com/EvolutionAPI/evolution-api.git synced 2025-07-13 15:14:49 -06:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge pull request #1354 from jeffersonfelixdev/hotfix/issue-1348

Browse Source 
Hotfix - shell injection vulnerability
This commit is contained in:
Davidson Gomes 2025-04-08 10:51:35 -03:00 committed by GitHub
commit 7c7dca9da9
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
3 changed files with 11 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
CHANGELOG.md
View File

@ -1,3 +1,9 @@
# 2.2.4 (hotfix)
### Fixed
* Shell injection vulnerability
# 2.2.3 (2025-02-03 11:52)
### Fixed

4
src/api/provider/sessions.ts
View File

@ -1,7 +1,7 @@
import { Auth, ConfigService, ProviderSession } from '@config/env.config';
import { Logger } from '@config/logger.config';
import axios from 'axios';
import { execSync } from 'child_process';
import { execFileSync } from 'child_process';
type ResponseSuccess = { status: number; data?: any };
type ResponseProvider = Promise<[ResponseSuccess?, Error?]>;
@ -36,7 +36,7 @@ export class ProviderFiles {
} catch (error) {
this.logger.error(['Failed to connect to the file server', error?.message, error?.stack]);
const pid = process.pid;
execSync(`kill -9 ${pid}`);
execFileSync('kill', ['-9', `${pid}`]);
}
}
}

5
src/api/services/monitor.service.ts
View File

@ -7,7 +7,7 @@ import { CacheConf, Chatwoot, ConfigService, Database, DelInstance, ProviderSess
import { Logger } from '@config/logger.config';
import { INSTANCE_DIR, STORE_DIR } from '@config/path.config';
import { NotFoundException } from '@exceptions';
import { execSync } from 'child_process';
import { execFileSync } from 'child_process';
import EventEmitter2 from 'eventemitter2';
import { rmSync } from 'fs';
import { join } from 'path';
@ -169,7 +169,8 @@ export class WAMonitoringService {
public async cleaningStoreData(instanceName: string) {
if (this.configService.get<Chatwoot>('CHATWOOT').ENABLED) {
execSync(`rm -rf ${join(STORE_DIR, 'chatwoot', instanceName + '*')}`);
const instancePath = join(STORE_DIR, 'chatwoot', instanceName);
execFileSync('rm', ['-rf', instancePath]);
}
const instance = await this.prismaRepository.instance.findFirst({