patch: fixes possible injection issue for notify-send

mikaelbr · Nov 9, 2020 · 2d3927b · 2d3927b
1 parent 6cd6cb9
commit 2d3927b
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 1 deletion.
diff --git a/lib/utils.js b/lib/utils.js
@@ -313,7 +313,9 @@ module.exports.constructArgumentList = function (options, extra) {
   };
 
   initial.forEach(function (val) {
-    args.push(escapeFn(val));
+    if (typeof val === 'string') {
+      args.push(escapeFn(val));
+    }
   });
   for (var key in options) {
     if (

diff --git a/test/notify-send.js b/test/notify-send.js
@@ -70,6 +70,17 @@ describe('notify-send', function () {
     notifier.notify({ message: 'some\n "me\'ss`age`"' });
   });
 
+  it.only('should only include strings as arguments', function (done) {
+    var expected = ['"HACKED"', '--expire-time', '"10000"'];
+
+    expectArgsListToBe(expected, done);
+    var notifier = new Notify({ suppressOsdCheck: true });
+    var options = JSON.parse(
+      '{"title":"HACKED", "message":["`touch HACKED`"]}'
+    );
+    notifier.notify(options);
+  });
+
   it('should send additional parameters as --"keyname"', function (done) {
     var expected = [
       '"title"',