octoleo/telegram-bot-bash
1
1
Fork 0
mirror of https://github.com/octoleo/telegram-bot-bash.git synced 2024-11-14 12:24:04 +00:00
Code Issues Projects Releases Wiki Activity

fix modules: jsshDB: fix removal of unwanted characters from untrusted input

Browse Source
This commit is contained in:
Kay Marquardt (Gnadelwartz) 2021-03-18 11:50:44 +01:00
parent e60ada0bfe
commit f1ea49426b
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
modules/jsonDB.sh
View File

@ -5,7 +5,7 @@
# This file is public domain in the USA and all free countries. # This file is public domain in the USA and all free countries.
# Elsewhere, consider it to be WTFPLv2. (wtfpl.net/txt/copying) # Elsewhere, consider it to be WTFPLv2. (wtfpl.net/txt/copying)
# #
#### $$VERSION$$ v1.51-dev-3-g85f7c07 #### $$VERSION$$ v1.51-dev-4-ge60ada0
# #
# source from commands.sh to use jsonDB functions # source from commands.sh to use jsonDB functions
# #
@ -355,10 +355,10 @@ function jssh_updateArray_async() {
# read JSON.sh style data and asssign to an ARRAY # read JSON.sh style data and asssign to an ARRAY
# $1 ARRAY name, must be declared with "declare -A ARRAY" before calling # $1 ARRAY name, must be declared with "declare -A ARRAY" before calling
Json2Array() { Json2Array() {
# match ["....."]\t and replace \t with = and print delete ` quote true false escape not escaped $
# shellcheck disable=SC1091,SC1090 # shellcheck disable=SC1091,SC1090
# step 1: output only basic pattern
[ -z "$1" ] || source <( printf "$1"'=( %s )'\ [ -z "$1" ] || source <( printf "$1"'=( %s )'\
"$(sed -E -n -e '/\["[-0-9a-zA-Z_,."]+"\]\+*\t/ s/\t/=/p' -e 's/[`´]//g' -e 's/=(true|false)/="\1"/' -e 's/([^\]|^)\$/\1\\$/g')" ) "$(sed -E -n -e 's/[`´]//g' -e 's/\t(true|false)/\t"\1"/' -e 's/([^\]|^)\$/\1\\$/g' -e '/\["[-0-9a-zA-Z_,."]+"\]\+*\t/ s/\t/=/p')" )
} }
# get Config Key from jssh file without jsshDB # get Config Key from jssh file without jsshDB
# output ARRAY as JSON.sh style data # output ARRAY as JSON.sh style data