USEFULL
/
gogs
mirror of https://github.com/gogs/gogs.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

ssh: ignore malformed "env" commands (#6094)

pull/6097/head
ᴜɴᴋɴᴡᴏɴ 2020-04-12 09:18:58 +08:00 committed by GitHub
parent ae107b2e6e
commit 26a2d0b2a1
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
internal/ssh/ssh.go
View File

@ -57,11 +57,19 @@ func handleServerConn(keyID string, chans <-chan ssh.NewChannel) {
continue continue
} }
args[0] = strings.TrimLeft(args[0], "\x04") args[0] = strings.TrimLeft(args[0], "\x04")
_, _, err := com.ExecCmdBytes("env", args[0]+"="+args[1])
// Sometimes the client could send malformed command (i.e. missing "="),
// see https://discuss.gogs.io/t/ssh/3106.
if args[0] == "" {
continue
}
_, stderr, err := com.ExecCmd("env", args[0]+"="+args[1])
if err != nil { if err != nil {
log.Error("env: %v", err) log.Error("env: %v - %s", err, stderr)
return return
} }
case "exec": case "exec":
cmdName := strings.TrimLeft(payload, "'()") cmdName := strings.TrimLeft(payload, "'()")
log.Trace("SSH: Payload: %v", cmdName) log.Trace("SSH: Payload: %v", cmdName)