fix(Command): filter "`" for comamnd (shell inject)

2026-05-06 21:50:39 +08:00 · 2023-03-27 12:07:44 +08:00
parent ab2b675247
commit dd1d1f2a8a
2 changed files with 5 additions and 5 deletions
--- a/application/libraries/service/Utility/Command.php
+++ b/application/libraries/service/Utility/Command.php
@@ -42,8 +42,8 @@ class Command
        // return '"' . $argument . '"';

        $pattern = [
-            '/(^|[^\\\\])((\\\\\\\\)*[\s\'\"\$\|])/',
-            '/(^|[^\\\\])((\\\\\\\\)*\\\\([^\s\'\"\|\$\\\\]|$))/'
+            '/(^|[^\\\\])((\\\\\\\\)*[\s\`\'\"\$\|])/',
+            '/(^|[^\\\\])((\\\\\\\\)*\\\\([^\s\`\'\"\|\$\\\\]|$))/'
        ];
        $replacement = [
            '$1\\\\$2',