Command Injection - array

sebhildebrandt · Feb 13, 2021 · d000198 · d000198
1 parent f947637
commit d000198
Showing 1 changed file with 26 additions and 18 deletions.
diff --git a/lib/internet.js b/lib/internet.js
@@ -34,6 +34,16 @@ function inetChecksite(url, callback) {
 
   return new Promise((resolve) => {
     process.nextTick(() => {
+      let result = {
+        url: url,
+        ok: false,
+        status: 404,
+        ms: null
+      };
+      if (typeof url !== "string") {
+        if (callback) { callback(result); }
+        return resolve(result);
+      }
       let urlSanitized = '';
       const s = util.sanitizeShellString(url, true);
       for (let i = 0; i <= 2000; i++) {
@@ -45,12 +55,7 @@ function inetChecksite(url, callback) {
           }
         }
       }
-      let result = {
-        url: urlSanitized,
-        ok: false,
-        status: 404,
-        ms: null
-      };
+      result.url = urlSanitized;
       try {
         if (urlSanitized && !util.isPrototypePolluted()) {
           let t = Date.now();
@@ -123,21 +128,24 @@ function inetLatency(host, callback) {
   }
 
   host = host || '8.8.8.8';
-  let hostSanitized = '';
-  const s = (util.isPrototypePolluted() ? '8.8.8.8' : util.sanitizeShellString(host, true)).trim();
-  for (let i = 0; i <= 2000; i++) {
-    if (!(s[i] === undefined)) {
-
-      s[i].__proto__.toLowerCase = util.stringToLower;
-      const sl = s[i].toLowerCase();
-      if (sl && sl[0] && !sl[1]) {
-        hostSanitized = hostSanitized + sl[0];
-      }
-    }
-  }
 
   return new Promise((resolve) => {
     process.nextTick(() => {
+      if (typeof host !== "string") {
+        if (callback) { callback(null); }
+        return resolve(null);
+      }
+      let hostSanitized = '';
+      const s = (util.isPrototypePolluted() ? '8.8.8.8' : util.sanitizeShellString(host, true)).trim();
+      for (let i = 0; i <= 2000; i++) {
+        if (!(s[i] === undefined)) {
+          s[i].__proto__.toLowerCase = util.stringToLower;
+          const sl = s[i].toLowerCase();
+          if (sl && sl[0] && !sl[1]) {
+            hostSanitized = hostSanitized + sl[0];
+          }
+        }
+      }
       let params;
       let filt;
       if (_linux || _freebsd || _openbsd || _netbsd || _darwin) {