* Validate dig arguments to prevent shell injection. * Only allow: domain names, DNS record types, and common dig flags. * Reject any argument containing shell metacharacters.
(args: string[])
| 12 | * Validate dig arguments to prevent shell injection. |
| 13 | * Only allow: domain names, DNS record types, and common dig flags. |
| 14 | * Reject any argument containing shell metacharacters. |
| 15 | */ |
| 16 | function sanitizeDigArgs(args: string[]): string[] | null { |
| 17 | // Allow common dig flags starting with + or -, domain names, and DNS types |
| 18 | for (const arg of args) { |
| 19 | // Block shell metacharacters and path traversal |
| 20 | if (/[;&|`$(){}!#<>'"\\]/.test(arg)) { |
| 21 | return null; |
| 22 | } |
| 23 | // Block path traversal |
| 24 | if (arg.includes("..") || arg.includes("/")) { |
| 25 | return null; |
| 26 | } |
| 27 | } |
| 28 | return args; |
| 29 | } |
| 30 |