Compare commits

...

4 Commits

Author SHA1 Message Date
liss-bot
aff403b116 docs: Updates contributors list 2025-04-13 03:36:26 +01:00
Alicia Sykes
50a11a5f50 Merge pull request #243 from Lissy93/sec/fix-com-inj-vul
security: Replace exec with execFile
2025-04-12 12:13:01 +01:00
Alicia Sykes
145711bdc7 ref: Bump version to 2.0.1 2025-04-12 12:12:51 +01:00
Alicia Sykes
0e4958aa10 security: Replace exec with execFile 2025-04-12 12:11:11 +01:00
3 changed files with 37 additions and 39 deletions

39
.github/README.md vendored
View File

@@ -1014,6 +1014,13 @@ Credit to the following users for contributing to Web-Check
<sub><b>Ulises Gascón</b></sub> <sub><b>Ulises Gascón</b></sub>
</a> </a>
</td> </td>
<td align="center">
<a href="https://github.com/CrazyWolf13">
<img src="https://avatars.githubusercontent.com/u/96661824?v=4" width="80;" alt="CrazyWolf13"/>
<br />
<sub><b>Tobias</b></sub>
</a>
</td>
<td align="center"> <td align="center">
<a href="https://github.com/PhiRequiem"> <a href="https://github.com/PhiRequiem">
<img src="https://avatars.githubusercontent.com/u/1323576?v=4" width="80;" alt="PhiRequiem"/> <img src="https://avatars.githubusercontent.com/u/1323576?v=4" width="80;" alt="PhiRequiem"/>
@@ -1028,6 +1035,8 @@ Credit to the following users for contributing to Web-Check
<sub><b>Nikolaos G. Ntaiko</b></sub> <sub><b>Nikolaos G. Ntaiko</b></sub>
</a> </a>
</td> </td>
</tr>
<tr>
<td align="center"> <td align="center">
<a href="https://github.com/Myzel394"> <a href="https://github.com/Myzel394">
<img src="https://avatars.githubusercontent.com/u/50424412?v=4" width="80;" alt="Myzel394"/> <img src="https://avatars.githubusercontent.com/u/50424412?v=4" width="80;" alt="Myzel394"/>
@@ -1035,8 +1044,6 @@ Credit to the following users for contributing to Web-Check
<sub><b>Myzel394</b></sub> <sub><b>Myzel394</b></sub>
</a> </a>
</td> </td>
</tr>
<tr>
<td align="center"> <td align="center">
<a href="https://github.com/murrple-1"> <a href="https://github.com/murrple-1">
<img src="https://avatars.githubusercontent.com/u/5559656?v=4" width="80;" alt="murrple-1"/> <img src="https://avatars.githubusercontent.com/u/5559656?v=4" width="80;" alt="murrple-1"/>
@@ -1072,6 +1079,8 @@ Credit to the following users for contributing to Web-Check
<sub><b>Gertje823</b></sub> <sub><b>Gertje823</b></sub>
</a> </a>
</td> </td>
</tr>
<tr>
<td align="center"> <td align="center">
<a href="https://github.com/epreston"> <a href="https://github.com/epreston">
<img src="https://avatars.githubusercontent.com/u/347224?v=4" width="80;" alt="epreston"/> <img src="https://avatars.githubusercontent.com/u/347224?v=4" width="80;" alt="epreston"/>
@@ -1079,8 +1088,6 @@ Credit to the following users for contributing to Web-Check
<sub><b>Ed Preston</b></sub> <sub><b>Ed Preston</b></sub>
</a> </a>
</td> </td>
</tr>
<tr>
<td align="center"> <td align="center">
<a href="https://github.com/dimitri-kandassamy"> <a href="https://github.com/dimitri-kandassamy">
<img src="https://avatars.githubusercontent.com/u/21193806?v=4" width="80;" alt="dimitri-kandassamy"/> <img src="https://avatars.githubusercontent.com/u/21193806?v=4" width="80;" alt="dimitri-kandassamy"/>
@@ -1110,7 +1117,7 @@ Huge thanks to these wonderful people, who sponsor me on GitHub, their support h
<tr> <tr>
<td align="center"> <td align="center">
<a href="https://github.com/vincentkoc"> <a href="https://github.com/vincentkoc">
<img src="https://avatars.githubusercontent.com/u/25068?v=4" width="80;" alt="vincentkoc"/> <img src="https://avatars.githubusercontent.com/u/25068?u=fbd5b2d51142daa4bdbc21e21953a3b8b8188a4a&v=4" width="80;" alt="vincentkoc"/>
<br /> <br />
<sub><b>Vincent Koc</b></sub> <sub><b>Vincent Koc</b></sub>
</a> </a>
@@ -1173,13 +1180,6 @@ Huge thanks to these wonderful people, who sponsor me on GitHub, their support h
<sub><b>Brian McGonagill</b></sub> <sub><b>Brian McGonagill</b></sub>
</a> </a>
</td> </td>
<td align="center">
<a href="https://github.com/arcestia">
<img src="https://avatars.githubusercontent.com/u/7936962?v=4" width="80;" alt="arcestia"/>
<br />
<sub><b>Laurensius Jeffrey</b></sub>
</a>
</td>
<td align="center"> <td align="center">
<a href="https://github.com/vlad-tim"> <a href="https://github.com/vlad-tim">
<img src="https://avatars.githubusercontent.com/u/11474041?u=eee43705b54d2ec9f51fc4fcce5ad18dd17c87e4&v=4" width="80;" alt="vlad-tim"/> <img src="https://avatars.githubusercontent.com/u/11474041?u=eee43705b54d2ec9f51fc4fcce5ad18dd17c87e4&v=4" width="80;" alt="vlad-tim"/>
@@ -1194,8 +1194,6 @@ Huge thanks to these wonderful people, who sponsor me on GitHub, their support h
<sub><b>HeliXZz</b></sub> <sub><b>HeliXZz</b></sub>
</a> </a>
</td> </td>
</tr>
<tr>
<td align="center"> <td align="center">
<a href="https://github.com/mryesiller"> <a href="https://github.com/mryesiller">
<img src="https://avatars.githubusercontent.com/u/24632172?u=0d20f2d615158f87cd60a3398d3efb026c32f291&v=4" width="80;" alt="mryesiller"/> <img src="https://avatars.githubusercontent.com/u/24632172?u=0d20f2d615158f87cd60a3398d3efb026c32f291&v=4" width="80;" alt="mryesiller"/>
@@ -1203,6 +1201,8 @@ Huge thanks to these wonderful people, who sponsor me on GitHub, their support h
<sub><b>Göksel Yeşiller</b></sub> <sub><b>Göksel Yeşiller</b></sub>
</a> </a>
</td> </td>
</tr>
<tr>
<td align="center"> <td align="center">
<a href="https://github.com/sushibait"> <a href="https://github.com/sushibait">
<img src="https://avatars.githubusercontent.com/u/26634535?v=4" width="80;" alt="sushibait"/> <img src="https://avatars.githubusercontent.com/u/26634535?v=4" width="80;" alt="sushibait"/>
@@ -1238,8 +1238,6 @@ Huge thanks to these wonderful people, who sponsor me on GitHub, their support h
<sub><b>Terminal Trove</b></sub> <sub><b>Terminal Trove</b></sub>
</a> </a>
</td> </td>
</tr>
<tr>
<td align="center"> <td align="center">
<a href="https://github.com/st617"> <a href="https://github.com/st617">
<img src="https://avatars.githubusercontent.com/u/128325650?v=4" width="80;" alt="st617"/> <img src="https://avatars.githubusercontent.com/u/128325650?v=4" width="80;" alt="st617"/>
@@ -1247,19 +1245,14 @@ Huge thanks to these wonderful people, who sponsor me on GitHub, their support h
<sub><b>st617</b></sub> <sub><b>st617</b></sub>
</a> </a>
</td> </td>
</tr>
<tr>
<td align="center"> <td align="center">
<a href="https://github.com/hudsonrock-partnerships"> <a href="https://github.com/hudsonrock-partnerships">
<img src="https://avatars.githubusercontent.com/u/163282900?u=5f2667f7fe5d284ac7a2da6b0800ea8970b0fcbf&v=4" width="80;" alt="hudsonrock-partnerships"/> <img src="https://avatars.githubusercontent.com/u/163282900?u=5f2667f7fe5d284ac7a2da6b0800ea8970b0fcbf&v=4" width="80;" alt="hudsonrock-partnerships"/>
<br /> <br />
<sub><b>hudsonrock-partnerships</b></sub> <sub><b>hudsonrock-partnerships</b></sub>
</a> </a>
</td>
<td align="center">
<a href="https://github.com/CarterPerez-dev">
<img src="https://avatars.githubusercontent.com/u/188120068?v=4" width="80;" alt="CarterPerez-dev"/>
<br />
<sub><b>Carter Perez</b></sub>
</a>
</td> </td>
</tr> </tr>
<tbody> <tbody>

View File

@@ -1,7 +1,7 @@
import puppeteer from 'puppeteer-core'; import puppeteer from 'puppeteer-core';
import chromium from 'chrome-aws-lambda'; import chromium from 'chrome-aws-lambda';
import middleware from './_common/middleware.js'; import middleware from './_common/middleware.js';
import { exec } from 'child_process'; import { execFile } from 'child_process';
import { promises as fs } from 'fs'; import { promises as fs } from 'fs';
import path from 'path'; import path from 'path';
import pkg from 'uuid'; import pkg from 'uuid';
@@ -20,32 +20,37 @@ const directChromiumScreenshot = async (url) => {
return new Promise((resolve, reject) => { return new Promise((resolve, reject) => {
const chromePath = process.env.CHROME_PATH || '/usr/bin/chromium'; const chromePath = process.env.CHROME_PATH || '/usr/bin/chromium';
const command = `${chromePath} --headless --disable-gpu --no-sandbox --screenshot=${screenshotPath} "${url}"`; const args = [
'--headless',
'--disable-gpu',
'--no-sandbox',
`--screenshot=${screenshotPath}`,
url
];
console.log(`[DIRECT-SCREENSHOT] Executing: ${chromePath} ${args.join(' ')}`);
console.log(`[DIRECT-SCREENSHOT] Executing command: ${command}`); execFile(chromePath, args, async (error, stdout, stderr) => {
exec(command, async (error, stdout, stderr) => {
if (error) { if (error) {
console.error(`[DIRECT-SCREENSHOT] Error executing Chromium: ${error.message}`); console.error(`[DIRECT-SCREENSHOT] Chromium error: ${error.message}`);
return reject(error); return reject(error);
} }
try { try {
// Read screenshot // Read the screenshot file
const screenshotData = await fs.readFile(screenshotPath); const screenshotData = await fs.readFile(screenshotPath);
console.log(`[DIRECT-SCREENSHOT] Read ${screenshotData.length} bytes from screenshot file`); console.log(`[DIRECT-SCREENSHOT] Screenshot read successfully`);
// Convert base64 // Convert to base64
const base64Data = screenshotData.toString('base64'); const base64Data = screenshotData.toString('base64');
// Clean await fs.unlink(screenshotPath).catch(err =>
await fs.unlink(screenshotPath).catch(err =>
console.warn(`[DIRECT-SCREENSHOT] Failed to delete temp file: ${err.message}`) console.warn(`[DIRECT-SCREENSHOT] Failed to delete temp file: ${err.message}`)
); );
resolve(base64Data); resolve(base64Data);
} catch (readError) { } catch (readError) {
console.error(`[DIRECT-SCREENSHOT] Error reading screenshot: ${readError.message}`); console.error(`[DIRECT-SCREENSHOT] Failed reading screenshot: ${readError.message}`);
reject(readError); reject(readError);
} }
}); });

View File

@@ -1,7 +1,7 @@
{ {
"name": "web-check", "name": "web-check",
"type": "module", "type": "module",
"version": "2.0.0", "version": "2.0.1",
"homepage": "https://web-check.xyz", "homepage": "https://web-check.xyz",
"scripts": { "scripts": {
"start": "node server", "start": "node server",