From e01ee36e6f06b5de130b218c01445fa68341b1ad Mon Sep 17 00:00:00 2001 From: Developer Date: Tue, 21 Apr 2026 22:42:08 -0400 Subject: [PATCH] Additional critical fixes: malware-scanner.sh - input validation & error handling MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ADDITIONAL ISSUES FIXED (7 major issues): 1. MISSING INPUT VALIDATION - Lines 2743, 2785 - Domain input now validated with regex (prevents injection, special chars) - Custom path now validated for existence and readability - Rejects invalid domain formats before processing 2. MALDET AVAILABILITY CHECK - Line 3035 - maldet_scan_submenu() now verifies maldet is installed before running - Prevents crashes when user selects maldet menu but scanner isn't installed - Shows helpful message directing user to installation 3. DIRECTORY CREATION ERROR HANDLING - Line 1283 - mkdir now checks for success, returns error on failure - chmod also checked with error handling - Prevents silent failures when /opt not writable or disk full 4. SESSION DIRECTORY RACE CONDITION - Line 1273 - Added $$ (process ID) and $RANDOM to session naming - Prevents collision when multiple users run simultaneously - Unique naming: malware-YYYYMMDD-HHMMSS-PID-RANDOM 5. CONTROL PANEL DETECTION VALIDATION - Line 2598 - Added check to verify control panel not "unknown" after detection - Prevents scanning with wrong directory structure - Shows clear error message with remediation steps 6. ARRAY BOUNDS VALIDATION - Line 3347 - Check available_scanners array not empty before displaying - Prevents crashes when no scanners installed - Shows helpful message to install scanners first 7. CUSTOM PATH READABILITY - Line 2793 - Validates path is readable (not just existent) - Prevents scanning paths with permission errors VALIDATION & TESTING: ✓ Syntax validation passed ✓ All input validation patterns tested ✓ Error handling branches verified ✓ Race condition fix verified (unique naming) CODE QUALITY IMPROVEMENTS: - Better error messages guide user to solutions - Defensive programming prevents crashes - Input sanitization prevents injection attacks - Array bounds checked before access --- modules/security/malware-scanner.sh | 76 +++++++++++++++++++++++++++-- 1 file changed, 72 insertions(+), 4 deletions(-) diff --git a/modules/security/malware-scanner.sh b/modules/security/malware-scanner.sh index 18a6c0d..4be53df 100755 --- a/modules/security/malware-scanner.sh +++ b/modules/security/malware-scanner.sh @@ -1269,8 +1269,8 @@ generate_standalone_scanner() { return 1 fi - # Create session ID and directory - local session_id="malware-$(date +%Y%m%d-%H%M%S)" + # Create session ID and directory (with PID and random for collision avoidance) + local session_id="malware-$(date +%Y%m%d-%H%M%S)-$$-$RANDOM" local session_dir="/opt/${session_id}" echo "" @@ -1279,8 +1279,19 @@ generate_standalone_scanner() { echo "Location: $session_dir" echo "" - # Create directory structure - mkdir -p "$session_dir"/{logs,results} + # Create directory structure with error checking + mkdir -p "$session_dir"/{logs,results} || { + echo -e "${RED}ERROR: Failed to create scan directory: $session_dir${NC}" + echo "Check that /opt is writable and has sufficient disk space" + read -p "Press Enter to continue..." + return 1 + } + + chmod 755 "$session_dir" || { + echo -e "${RED}ERROR: Failed to set permissions on $session_dir${NC}" + read -p "Press Enter to continue..." + return 1 + } # Create standalone scan script cat > "$session_dir/scan.sh" << 'STANDALONE_EOF' @@ -2585,6 +2596,25 @@ launch_standalone_scanner_menu() { echo "" if ! detect_control_panel; then + echo -e "${RED}ERROR: Control panel detection failed${NC}" + echo "" + echo "Cannot determine correct directory structure for scan." + echo "Your system may be using an unsupported control panel or" + echo "be configured as standalone." + echo "" + read -p "Press Enter to continue..." + return 1 + fi + + # Verify detection didn't just set to "unknown" + if [ "$CONTROL_PANEL" = "unknown" ]; then + echo -e "${RED}ERROR: Unable to detect control panel${NC}" + echo "" + echo "Cannot safely scan without knowing the directory structure." + echo "You can still:" + echo " • Use custom path scanning option" + echo " • Manually configure paths for your control panel" + echo "" read -p "Press Enter to continue..." return 1 fi @@ -2748,6 +2778,16 @@ launch_standalone_scanner_menu() { return 1 fi + # Validate domain format (prevent injection and invalid domains) + # Accepts: example.com, sub.example.com, etc. + # Rejects: special chars, spaces, wildcards, shell metacharacters + if [[ ! "$domain" =~ ^[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$ ]]; then + echo -e "${RED}Invalid domain format${NC}" + echo "Domain must contain only letters, numbers, hyphens, and dots" + read -p "Press Enter to continue..." + return 1 + fi + # Find docroot for domain (FIXED: more specific matching with word boundaries) # Escape domain for use in regex (handle dots, hyphens, etc.) local domain_escaped=$(printf '%s\n' "$domain" | sed 's/[.]/\\./g' | sed 's/-/\\-/g') @@ -2786,6 +2826,13 @@ launch_standalone_scanner_menu() { return 1 fi + # Verify path is readable + if [ ! -r "$custom_path" ]; then + echo -e "${RED}Path is not readable (permission denied): $custom_path${NC}" + read -p "Press Enter to continue..." + return 1 + fi + scan_paths=("$custom_path") scan_description="custom path $custom_path" ;; @@ -3016,6 +3063,18 @@ delete_standalone_sessions() { # Main scan menu # Maldet-specific scan menu (dedicated section for fastest scanner) maldet_scan_submenu() { + # Verify Maldet is installed before proceeding + if ! is_scanner_cached "maldet"; then + echo "" + echo -e "${RED}ERROR: Maldet is not installed${NC}" + echo "" + echo "To install Maldet, use option 10 from the main menu:" + echo " Main Menu → Install Maldet (fast, Linux-specific)" + echo "" + read -p "Press Enter to return to main menu..." + return 1 + fi + while true; do echo "" print_header "Maldet Scanner - Linux Malware Detection" @@ -3284,6 +3343,15 @@ view_scan_results() { 1) # Toolkit scan results echo "" + + # Check if any scanners are available + if [ ${#available_scanners[@]} -eq 0 ]; then + echo -e "${YELLOW}No scanners are currently installed${NC}" + echo "Use option 13 from main menu to install scanners" + read -p "Press Enter to continue..." + return 1 + fi + echo "Select scanner to view results:" local i=1 for scanner in "${available_scanners[@]}"; do