Skip to content

[Bug] Insufficient input sanitization while creating folder #25

@tymwitko

Description

@tymwitko

🐛 Bug Description

The text input field allows the user to enter any command instead of just the name of the folder.

📱 Environment

  • sysAdmin version: 1.1.1
  • Android/iOS version: Android 15
  • Device model: Samsung Galaxy S21
  • Server OS: Debian 12

🔄 Steps To Reproduce

  1. Connect to server
  2. Enter file explorer and go to a location where you can create folders
  3. Press "Create folder"
  4. Enter a name followed by a command, e.g. folder_name1 mkdir folder2_name

🧐 Expected Behavior

Only one folder with the name folder_name1 mkdir folder2_name should get created.

🚨 Actual Behavior

Injected command gets triggered. In the described example two folders get created, folder_name1 and folder_name2.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions