GlcoinCore/blitz_api
1
0
Fork 0
mirror of https://github.com/fusion44/blitz_api.git synced 2026-08-13 11:52:45 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 1
blitz_api/app/lightning/impl/specializations
History
Exact
fusion44 4355c8eabd
fix(lightning): prevent shell injection in CLN local calls 
Two authenticated code paths interpolated user-controlled input into a
shell command:

- decode_pay_request passed the bolt11 string into _make_local_call,
  which ran it via create_subprocess_shell; a crafted /lightning/
  decode-pay-req request could execute arbitrary commands. Switch
  _make_local_call to create_subprocess_exec with a discrete argv list.
- blitz_cln_unlock interpolated the wallet password into a
  cl.hsmtool.sh invocation run through a shell, and logged it in the
  clear. shlex.quote the interpolated values and mark the call
  sensitive=True.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-03 19:58:41 +02:00
..
blitz_common.py fix(lightning): prevent shell injection in CLN local calls 2026-07-03 19:58:41 +02:00
cln_grpc_blitz.py feat: make config loading more flexible 2025-03-23 17:43:39 +01:00
cln_jrpc_blitz.py feat: make config loading more flexible 2025-03-23 17:43:39 +01:00
README.md refactor: switch to domain driven directory layout 2022-10-03 20:22:00 +02:00

README.md

Specializations

Some platforms implement special features on top of the main lightning implementation. This is the place to keep the code for these specializations.

Example: RaspiBlitz implements a specialization for Core Lightning to unlock the wallet.

ℹ️ This keeps dependencies as lean as possible for the main implementations. RaspiBlitz Core Lightning unlock specialization has a redis dependency but the main implementation does not.