htwkmooc/poseidon
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add single quotes for inner command.

Browse Source 
Change to bash as interpreter.
Forbid single quotes for user commands.
This commit is contained in:
Maximilian Paß
2022-10-21 16:52:22 +01:00
committed by Sebastian Serth
parent 4c25473c9e
commit 8950ab3776
8 changed files with 70 additions and 48 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
internal/api/runners_test.go
View File

@ -236,6 +236,21 @@ func (s *RunnerRouteTestSuite) TestExecuteRoute() {
s.Equal(http.StatusBadRequest, recorder.Code)
})
s.Run("forbidden characters in command", func() {
recorder := httptest.NewRecorder()
executionRequest := dto.ExecutionRequest{
Command: "echo 'forbidden'",
TimeLimit: 10,
}
body, err := json.Marshal(executionRequest)
s.Require().NoError(err)
request, err := http.NewRequest(http.MethodPost, path.String(), bytes.NewReader(body))
s.Require().NoError(err)
s.router.ServeHTTP(recorder, request)
s.Equal(http.StatusBadRequest, recorder.Code)
})
}
func TestUpdateFileSystemRouteTestSuite(t *testing.T) {