zerogterm 0.2.0-alpha.2 → 0.3.0-alpha.1

package/dist/main/main/session-service.js

@@ -6,8 +6,13 @@ import { promisify } from 'node:util';
 const execFileAsync = promisify(execFile);
 const require = createRequire(import.meta.url);
 const NAME = /^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,48}$/;
-/** host, user@host, host:port, user@host:port — no shell metacharacters. */
-const SSH_TARGET = /^(?:([A-Za-z0-9._-]+)@)?([A-Za-z0-9.-]+)(?::(\d{1,5}))?$/;
+/**
+ * host, user@host, host:port, user@host:port — no shell metacharacters.
+ * Host and user must start alphanumeric: a leading '-' would be parsed by
+ * ssh's getopt as an option, and `-Fsome.cfg` can point ssh at an attacker
+ * -chosen config file (hence ProxyCommand) without any shell involvement.
+ */
+const SSH_TARGET = /^(?:([A-Za-z0-9][A-Za-z0-9._-]*)@)?([A-Za-z0-9][A-Za-z0-9.-]*)(?::(\d{1,5}))?$/;
 export function validateSessionName(name) {
     const value = name.trim();
     if (!NAME.test(value)) {
@@ -32,7 +37,8 @@ export function validateSshTarget(input) {
     const args = ['-tt'];
     if (portText)
         args.push('-p', portText);
-    args.push(destination);
+    // '--' ends option parsing, so the destination can never be read as a flag.
+    args.push('--', destination);
     return { target: value, args };
 }
 export function parseWslDistributions(output) {
@@ -198,7 +204,9 @@ export class ScreenService {
                 this.onEvent?.('attached', fallback, true);
                 return { ...fallback };
             }
-            const name = id.slice('local:'.length);
+            // Session ids cross the IPC boundary from the renderer, so re-validate
+            // rather than trusting that createLocal produced this one.
+            const name = validateSessionName(id.slice('local:'.length));
             this.spawnCommand(id, 'screen', ['-x', name], onData, onExit);
             this.onEvent?.('attached', existing, true);
             return { ...existing, status: 'connected', persistence: 'screen' };
@@ -226,7 +234,7 @@ export class ScreenService {
             const fallback = this.fallbackLocalSessions.get(id);
             if (fallback)
                 return fallback;
-            const name = id.slice('local:'.length);
+            const name = validateSessionName(id.slice('local:'.length));
             return {
                 id,
                 name,

package/dist/main/main/ssh-inventory.js

@@ -2,7 +2,10 @@ import { homedir } from 'node:os';
 import { readFile } from 'node:fs/promises';
 const TOKEN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
 const HOST = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,253}$/;
-const USER = /^[A-Za-z0-9._-]{1,64}$/;
+// Must start alphanumeric like TOKEN/HOST above: the user is concatenated into
+// `user@host`, so a leading '-' makes the whole destination look like an option
+// to ssh's getopt (`-Fevil.cfg@host` reads an attacker-chosen config file).
+const USER = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
 const SCREEN = /^[A-Za-z0-9][A-Za-z0-9_.-]{0,48}$/;
 function words(value) {
     const result = [];