cschantz/Linux-Server-Management-Toolkit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix ESCAPE issues in IP reputation and user manager

Browse Source 
- Added -- separator to grep/awk commands in lib/ip-reputation.sh (4 fixes)
- Added -- separator to grep commands in lib/user-manager.sh (2 fixes)
- Prevents filename injection attacks

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
This commit is contained in:
cschantz
2026-01-09 16:23:17 -05:00
parent c6d5affbee
commit 630cea7cb7
2 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/ip-reputation.sh
+4 -4
View File
@@ -97,7 +97,7 @@ lookup_ip() {
# Fast path: Check hash bucket first (much smaller file to grep)
if [ -f "$hash_file" ]; then
# Hash bucket contains line numbers for IPs in this bucket
local line_num=$(grep -m 1 "^${ip}|" "$hash_file" 2>/dev/null | cut -d'|' -f2)
local line_num=$(grep -m 1 "^${ip}|" -- "$hash_file" 2>/dev/null | cut -d'|' -f2)
if [ -n "$line_num" ]; then
# Direct line access - O(1) lookup!
sed -n "${line_num}p" "$IP_REP_DB" 2>/dev/null
@@ -402,7 +402,7 @@ cleanup_old_ips() {
local temp_file="${IP_REP_DB}.tmp"
# Keep only IPs seen within the cutoff time
awk -F'|' -v cutoff="$cutoff_time" '$7 >= cutoff' "$IP_REP_DB" > "$temp_file"
awk -F'|' -v cutoff="$cutoff_time" '$7 >= cutoff' -- "$IP_REP_DB" > "$temp_file"
mv "$temp_file" "$IP_REP_DB"
@@ -538,7 +538,7 @@ import_ips_from_log() {
[ ! -f "$log_file" ] && return 1
# Extract IPs and count occurrences
grep -oE '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' "$log_file" | \
grep -oE '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' -- "$log_file" | \
sort | uniq -c | while read count ip; do
update_ip_reputation "$ip" "$count" "$score_per_hit" 0 "Imported from $log_file"
done
@@ -609,7 +609,7 @@ record_ip_ban() {
# Write updated entry (remove old, add new)
local temp_file="${IP_REP_DB}.tmp.$$"
grep -v "^${ip}|" "$IP_REP_DB" > "$temp_file" 2>/dev/null || touch "$temp_file"
grep -v "^${ip}|" -- "$IP_REP_DB" > "$temp_file" 2>/dev/null || touch "$temp_file"
echo "$ip|$hit_count|$rep_score|$country|$attack_flags|$first_seen|$last_seen|$last_activity|$notes|$ban_count|$last_ban" >> "$temp_file"
mv "$temp_file" "$IP_REP_DB"
else
lib/user-manager.sh
+2 -2
View File
@@ -124,8 +124,8 @@ get_cpanel_user_info() {
fi
# Parse cPanel user file
local primary_domain=$(grep "^DNS=" "$user_file" | cut -d= -f2)
local email=$(grep "^CONTACTEMAIL=" "$user_file" | cut -d= -f2)
local primary_domain=$(grep "^DNS=" -- "$user_file" | cut -d= -f2)
local email=$(grep "^CONTACTEMAIL=" -- "$user_file" | cut -d= -f2)
# cPanel doesn't store HOMEDIR in user file - it's always /home/username
local home_dir="/home/${username}"