| 389 | } |
| 390 | |
| 391 | bool ExecuteTerminalCommandTool::areArgumentsSafe(const QString &args) const |
| 392 | { |
| 393 | if (args.isEmpty()) { |
| 394 | return true; |
| 395 | } |
| 396 | |
| 397 | // Check for null bytes |
| 398 | if (args.contains(QChar('\0'))) { |
| 399 | LOG_MESSAGE("ExecuteTerminalCommandTool: Null byte found in args"); |
| 400 | return false; |
| 401 | } |
| 402 | |
| 403 | static const QStringList dangerousPatterns = { |
| 404 | ";", // Command separator |
| 405 | "&", // Command separator / background execution |
| 406 | "|", // Pipe operator |
| 407 | ">", // Output redirection |
| 408 | "<", // Input redirection |
| 409 | "`", // Command substitution |
| 410 | "$(", // Command substitution |
| 411 | "${", // Variable expansion |
| 412 | "\n", // Newline (could start new command) |
| 413 | "\r", // Carriage return |
| 414 | #ifdef Q_OS_WIN |
| 415 | "^", // Escape character in cmd.exe (can bypass other checks) |
| 416 | "%", // Environment variable expansion on Windows |
| 417 | #endif |
| 418 | }; |
| 419 | |
| 420 | for (const QString &pattern : dangerousPatterns) { |
| 421 | if (args.contains(pattern)) { |
| 422 | LOG_MESSAGE(QString("ExecuteTerminalCommandTool: Dangerous pattern '%1' found in args") |
| 423 | .arg(pattern)); |
| 424 | return false; |
| 425 | } |
| 426 | } |
| 427 | |
| 428 | return true; |
| 429 | } |
| 430 | |
| 431 | QString ExecuteTerminalCommandTool::sanitizeOutput(const QString &output, qint64 totalSize) const |
| 432 | { |