NeoAnd/evolution-api
1
0
Fork 0
mirror of https://github.com/EvolutionAPI/evolution-api.git synced 2025-07-21 11:37:23 -06:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

Merge pull request #1354 from jeffersonfelixdev/hotfix/issue-1348

Browse Source 
Hotfix - shell injection vulnerability
This commit is contained in:
Davidson Gomes 2025-04-08 10:51:35 -03:00 committed by GitHub
commit 7c7dca9da9
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
3 changed files with 11 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
CHANGELOG.md
View File

@ -1,3 +1,9 @@
# 2.2.4 (hotfix)
### Fixed
* Shell injection vulnerability
# 2.2.3 (2025-02-03 11:52) # 2.2.3 (2025-02-03 11:52)
### Fixed ### Fixed

4
src/api/provider/sessions.ts
View File

@ -1,7 +1,7 @@
import { Auth, ConfigService, ProviderSession } from '@config/env.config'; import { Auth, ConfigService, ProviderSession } from '@config/env.config';
import { Logger } from '@config/logger.config'; import { Logger } from '@config/logger.config';
import axios from 'axios'; import axios from 'axios';
import { execSync } from 'child_process'; import { execFileSync } from 'child_process';
type ResponseSuccess = { status: number; data?: any }; type ResponseSuccess = { status: number; data?: any };
type ResponseProvider = Promise<[ResponseSuccess?, Error?]>; type ResponseProvider = Promise<[ResponseSuccess?, Error?]>;
@ -36,7 +36,7 @@ export class ProviderFiles {
} catch (error) { } catch (error) {
this.logger.error(['Failed to connect to the file server', error?.message, error?.stack]); this.logger.error(['Failed to connect to the file server', error?.message, error?.stack]);
const pid = process.pid; const pid = process.pid;
execSync(`kill -9 ${pid}`); execFileSync('kill', ['-9', `${pid}`]);
} }
} }
} }

5
src/api/services/monitor.service.ts
View File

@ -7,7 +7,7 @@ import { CacheConf, Chatwoot, ConfigService, Database, DelInstance, ProviderSess
import { Logger } from '@config/logger.config'; import { Logger } from '@config/logger.config';
import { INSTANCE_DIR, STORE_DIR } from '@config/path.config'; import { INSTANCE_DIR, STORE_DIR } from '@config/path.config';
import { NotFoundException } from '@exceptions'; import { NotFoundException } from '@exceptions';
import { execSync } from 'child_process'; import { execFileSync } from 'child_process';
import EventEmitter2 from 'eventemitter2'; import EventEmitter2 from 'eventemitter2';
import { rmSync } from 'fs'; import { rmSync } from 'fs';
import { join } from 'path'; import { join } from 'path';
@ -169,7 +169,8 @@ export class WAMonitoringService {
public async cleaningStoreData(instanceName: string) { public async cleaningStoreData(instanceName: string) {
if (this.configService.get<Chatwoot>('CHATWOOT').ENABLED) { if (this.configService.get<Chatwoot>('CHATWOOT').ENABLED) {
execSync(`rm -rf ${join(STORE_DIR, 'chatwoot', instanceName + '*')}`); const instancePath = join(STORE_DIR, 'chatwoot', instanceName);
execFileSync('rm', ['-rf', instancePath]);
} }
const instance = await this.prismaRepository.instance.findFirst({ const instance = await this.prismaRepository.instance.findFirst({