Skip to content

Conversation

@mrsafalpiya
Copy link
Contributor

This pull request improves the security of shell command execution in backend/dockerMailserver.js by introducing proper escaping of user-supplied arguments. The most important changes include adding a utility function to escape shell arguments and updating all relevant command invocations to use this function, reducing the risk of shell injection vulnerabilities.

Security improvements for shell command execution:

  • Added a new escapeShellArg function that safely escapes strings for use in shell commands by wrapping them in single quotes and escaping internal quotes.
  • Updated addAccount, updateAccountPassword, and deleteAccount functions to use escapeShellArg for email and password arguments when invoking shell commands. [1] [2] [3]
  • Updated addAlias and deleteAlias functions to use escapeShellArg for source and destination arguments in shell commands. [1] [2]

@dunaj-dev dunaj-dev merged commit f126871 into dunaj-dev:master Oct 12, 2025
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants