Merge pull request #1 from EffectRenan/master

Fix Command Injection vulnerability
yibn2008 · Apr 1, 2021 · 4ca6a5c · 4ca6a5c
2 parents 723f44d + a48fd29
commit 4ca6a5c
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/lib/find.js b/lib/find.js
@@ -57,7 +57,12 @@ function find (by, value, strict) {
     if (!(by in findBy)) {
       reject(new Error(`do not support find by "${by}"`))
     } else {
-      findBy[by](value, strict).then(resolve, reject)
+      if (by === 'pid' && typeof value !== 'number')
+        reject(new Error(`pid must be a number`))
+      else if (by === 'port' && typeof value !== 'number')
+        reject(new Error(`port must be a number`))
+      else
+        findBy[by](value, strict).then(resolve, reject)
     }
   })
 }