From 66e44606af9e2ec76d3fa5b6117021a320a25400 Mon Sep 17 00:00:00 2001 From: Hermes Date: Sat, 8 Aug 2026 03:26:55 -0700 Subject: [PATCH] =?UTF-8?q?[grade=3DA]=20P0-2:=20ca.js=20pkcs12=20password?= =?UTF-8?q?=20=E2=80=94=20execSync=20template=20literal=20=E2=86=92=20exec?= =?UTF-8?q?FileSync=20argv=20(no=20shell)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- dashcaddy-api/routes/ca.js | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/dashcaddy-api/routes/ca.js b/dashcaddy-api/routes/ca.js index a9ac9a8..0616d53 100644 --- a/dashcaddy-api/routes/ca.js +++ b/dashcaddy-api/routes/ca.js @@ -2,7 +2,7 @@ const express = require('express'); const fs = require('fs'); const fsp = require('fs').promises; const path = require('path'); -const { execSync } = require('child_process'); +const { execSync, execFileSync } = require('child_process'); const { exists } = require('../src/utilities/fs-helpers'); const { ValidationError } = require('../src/utilities/errors'); const { ok } = require('../src/utils/responses'); @@ -207,7 +207,9 @@ ${safeDomain.includes('.') ? `DNS.2 = *.${safeDomain}` : ''}`; const rootCertContent = await fsp.readFile(rootCert, 'utf8'); await fsp.writeFile(fullChainFile, serverCertContent + '\n' + intermediateCertContent + '\n' + rootCertContent); - execSync(`openssl pkcs12 -export -out "${pfxFile}" -inkey "${keyFile}" -in "${certFile}" -certfile "${intermediateCert}" -password "pass:${password}"`, { stdio: 'pipe' }); + // P0-2 fix: was execSync(`... -password "pass:${password}"`) which interpolates the user-controlled + // password into a shell string. execFileSync passes it as an argv element instead, no shell parsing. + execFileSync('openssl', ['pkcs12', '-export', '-out', pfxFile, '-inkey', keyFile, '-in', certFile, '-certfile', intermediateCert, '-password', `pass:${password}`], { stdio: 'pipe' }); const keyContent = await fsp.readFile(keyFile, 'utf8'); await fsp.writeFile(pemFile, keyContent + '\n' + serverCertContent + '\n' + intermediateCertContent);