GlcoinCore/acme.sh
1
0
Fork 0
mirror of https://github.com/acmesh-official/acme.sh.git synced 2026-08-13 12:33:30 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 27

_date2time: pass date via argv to python to prevent code injection (#6463)

Browse source 
https://github.com/acmesh-official/acme.sh/issues/6463
This commit is contained in:
neil 2026-07-04 19:14:36 +08:00
parent 917bebd460
commit a105126063
1 changed files with 9 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

12
acme.sh
View file

@ -1895,12 +1895,13 @@ _date2time() {
if gdate -u -d "$(echo "$1" | tr -d "Z" | tr "T" ' ')" +"%s" 2>/dev/null; then
return
fi
#Omnios
if python3 -c "import datetime; print(int(datetime.datetime.strptime(\"$1\", \"%Y-%m-%d %H:%M:%S\").replace(tzinfo=datetime.timezone.utc).timestamp()))" 2>/dev/null; then
#Omnios. Pass the date as argv (sys.argv[1]) instead of interpolating it into
#the -c program text, so a quote in the input cannot inject Python code.
if python3 -c "import datetime,sys; print(int(datetime.datetime.strptime(sys.argv[1], \"%Y-%m-%d %H:%M:%S\").replace(tzinfo=datetime.timezone.utc).timestamp()))" "$1" 2>/dev/null; then
return
fi
#Omnios
if python3 -c "import datetime; print(int(datetime.datetime.strptime(\"$1\", \"%Y-%m-%dT%H:%M:%SZ\").replace(tzinfo=datetime.timezone.utc).timestamp()))" 2>/dev/null; then
if python3 -c "import datetime,sys; print(int(datetime.datetime.strptime(sys.argv[1], \"%Y-%m-%dT%H:%M:%SZ\").replace(tzinfo=datetime.timezone.utc).timestamp()))" "$1" 2>/dev/null; then
return
fi
_err "Cannot parse _date2time $1"
@ -2992,6 +2993,11 @@ _initAPI() {
return 0
fi
_err "Cannot init API for $_api_server"
if [ "$_api_server" = "$CA_ZEROSSL" ]; then
_info "$(__green "If this host is IPv6-only: ZeroSSL currently has no IPv6 endpoint.")"
_info "$(__green "Try another CA, e.g.: $PROJECT_ENTRY --set-default-ca --server letsencrypt")"
_info "See: $(__green "https://github.com/acmesh-official/acme.sh/issues/6872")"
fi
return 1
}