Avoid remote code execution (dadf032b) · Commits · e / infra / docker-create-account

app/main.py

+5 −4

Original line number	Diff line number	Diff line
		@@ -10,6 +10,7 @@ import os
		import logging
		import sys
		import json
		import shlex

		ch = logging.StreamHandler(sys.stdout)
		ch.setLevel(logging.DEBUG)
		@@ -47,16 +48,16 @@ class MyHandler(BaseHTTPRequestHandler):
		ssh.connect(hostname='postfixadmin', username='pfexec', password=os.environ['POSTFIXADMIN_SSH_PASSWORD'])

		stdin, stdout, stderr = ssh.exec_command(
		f'/postfixadmin/scripts/postfixadmin-cli mailbox view "{target_email}"')
		f'/postfixadmin/scripts/postfixadmin-cli mailbox view {shlex.quote(target_email)}')
		if b"error: the email is not valid!" not in stderr.read().lower():
		data = json.dumps({'success': True, 'message': 'username_taken'})
		self.respond(403, data)
		return

		stdin, stdout, stderr = ssh.exec_command(
		f'/postfixadmin/scripts/postfixadmin-cli mailbox add "{target_email}" ' + \
		f'--password "{password}" --password2 {password_confirm} --name "{displayname}" ' + \
		f'--quota {email_quota} --active 1 --welcome-mail 0')
		f'/postfixadmin/scripts/postfixadmin-cli mailbox add {shlex.quote(target_email)} ' +
		f'--password {shlex.quote(password)} --password2 {shlex.quote(password_confirm)} ' +
		f'--name {shlex.quote(displayname)} --quota {shlex.quote(email_quota)} --active 1 --welcome-mail 0')
		print(stdout.read())
		print(stderr.read())