sami7777/dashcaddy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

[grade=A] P0-2: ca.js pkcs12 password — execSync template literal → execFileSync argv (no shell)
CI / Test & Lint (push) Has been cancelled
Details
CI / Security audit (push) Has been cancelled
Details

Browse Source
This commit is contained in:
Hermes
2026-08-08 03:26:55 -07:00
parent a042645299
commit 66e44606af
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dashcaddy-api/routes/ca.js
+4 -2
View File
@@ -2,7 +2,7 @@ const express = require('express');
const fs = require('fs'); const fs = require('fs');
const fsp = require('fs').promises; const fsp = require('fs').promises;
const path = require('path'); const path = require('path');
const { execSync } = require('child_process'); const { execSync, execFileSync } = require('child_process');
const { exists } = require('../src/utilities/fs-helpers'); const { exists } = require('../src/utilities/fs-helpers');
const { ValidationError } = require('../src/utilities/errors'); const { ValidationError } = require('../src/utilities/errors');
const { ok } = require('../src/utils/responses'); const { ok } = require('../src/utils/responses');
@@ -207,7 +207,9 @@ ${safeDomain.includes('.') ? `DNS.2 = *.${safeDomain}` : ''}`;
const rootCertContent = await fsp.readFile(rootCert, 'utf8'); const rootCertContent = await fsp.readFile(rootCert, 'utf8');
await fsp.writeFile(fullChainFile, serverCertContent + '\n' + intermediateCertContent + '\n' + rootCertContent); await fsp.writeFile(fullChainFile, serverCertContent + '\n' + intermediateCertContent + '\n' + rootCertContent);
execSync(`openssl pkcs12 -export -out "${pfxFile}" -inkey "${keyFile}" -in "${certFile}" -certfile "${intermediateCert}" -password "pass:${password}"`, { stdio: 'pipe' }); // P0-2 fix: was execSync(`... -password "pass:${password}"`) which interpolates the user-controlled
// password into a shell string. execFileSync passes it as an argv element instead, no shell parsing.
execFileSync('openssl', ['pkcs12', '-export', '-out', pfxFile, '-inkey', keyFile, '-in', certFile, '-certfile', intermediateCert, '-password', `pass:${password}`], { stdio: 'pipe' });
const keyContent = await fsp.readFile(keyFile, 'utf8'); const keyContent = await fsp.readFile(keyFile, 'utf8');
await fsp.writeFile(pemFile, keyContent + '\n' + serverCertContent + '\n' + intermediateCertContent); await fsp.writeFile(pemFile, keyContent + '\n' + serverCertContent + '\n' + intermediateCertContent);