Skip to content

Commit 897b97e

Browse files
DrenzzzDrenzzz
authored
Merge pull request #15 from Drenzzz/test
Revert "feat(security): add comprehensive input sanitization"
2 parents 1c4332c + 09deb0a commit 897b97e

9 files changed

Lines changed: 25 additions & 290 deletions

‎backend/device_service.go‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -251,9 +251,7 @@ func (a *App) GetDeviceMode() (string, error) {
251251
}
252252

253253
func (a *App) Reboot(mode string) error {
254-
if err := ValidateRebootMode(mode); err != nil {
255-
return fmt.Errorf("invalid reboot mode: %w", err)
256-
}
254+
257255

258256
connectionMode, detectionErr := a.detectDeviceMode()
259257
if detectionErr != nil {

‎backend/executor.go‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -129,7 +129,9 @@ func (a *App) runCommandRaw(name string, args ...string) (string, error) {
129129
}
130130

131131
func (a *App) runShellCommand(shellCommand string) (string, error) {
132-
if ContainsDangerousShellChars(shellCommand) {
132+
// Security: simplistic check to prevent completely reckless command injection
133+
// Ideally, shell commands should be avoided in favor of direct args, but adb shell requires it often.
134+
if strings.ContainsAny(shellCommand, "&|;") {
133135
return "", fmt.Errorf("illegal characters in command")
134136
}
135137

‎backend/fastboot_service.go‎

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -13,11 +13,8 @@ func (a *App) WipeData() error {
1313
}
1414

1515
func (a *App) FlashPartition(partition string, filePath string) error {
16-
if err := ValidatePartitionName(partition); err != nil {
17-
return fmt.Errorf("invalid partition name: %w", err)
18-
}
19-
if err := ValidateFilePath(filePath); err != nil {
20-
return fmt.Errorf("invalid file path: %w", err)
16+
if partition == "" || filePath == "" {
17+
return fmt.Errorf("partition and file path cannot be empty")
2118
}
2219

2320
output, err := a.runCommand("fastboot", "flash", partition, filePath)
@@ -27,7 +24,6 @@ func (a *App) FlashPartition(partition string, filePath string) error {
2724
return nil
2825
}
2926

30-
3127
func (a *App) GetFastbootDevices() ([]Device, error) {
3228
output, err := a.runCommand("fastboot", "devices")
3329
if err != nil {

‎backend/file_service.go‎

Lines changed: 6 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,7 @@ import (
99
)
1010

1111
func (a *App) ListFiles(path string) ([]FileEntry, error) {
12-
if err := ValidateRemotePath(path); err != nil {
13-
return nil, fmt.Errorf("invalid path: %w", err)
14-
}
12+
1513

1614
// List files uses default timeout (60s) which is sufficient
1715
output, err := a.runCommand("adb", "shell", "ls", "-lA", path)
@@ -102,12 +100,7 @@ func (a *App) ListFiles(path string) ([]FileEntry, error) {
102100
}
103101

104102
func (a *App) PushFile(localPath string, remotePath string) (string, error) {
105-
if err := ValidateFilePath(localPath); err != nil {
106-
return "", fmt.Errorf("invalid local path: %w", err)
107-
}
108-
if err := ValidateRemotePath(remotePath); err != nil {
109-
return "", fmt.Errorf("invalid remote path: %w", err)
110-
}
103+
111104

112105
a.opMutex.Lock()
113106
ctx, cancel := context.WithTimeout(context.Background(), 30*time.Minute)
@@ -134,12 +127,7 @@ func (a *App) PushFile(localPath string, remotePath string) (string, error) {
134127
}
135128

136129
func (a *App) PullFile(remotePath string, localPath string) (string, error) {
137-
if err := ValidateRemotePath(remotePath); err != nil {
138-
return "", fmt.Errorf("invalid remote path: %w", err)
139-
}
140-
if err := ValidateFilePath(localPath); err != nil {
141-
return "", fmt.Errorf("invalid local path: %w", err)
142-
}
130+
143131

144132
a.opMutex.Lock()
145133
// No timeout for file transfers, only user cancellation
@@ -167,12 +155,7 @@ func (a *App) PullFile(remotePath string, localPath string) (string, error) {
167155
}
168156

169157
func (a *App) CreateFolder(fullPath string) (string, error) {
170-
if err := ValidateRemotePath(fullPath); err != nil {
171-
return "", fmt.Errorf("invalid path: %w", err)
172-
}
173-
174-
sanitizedPath := SanitizeShellArg(fullPath)
175-
command := fmt.Sprintf("mkdir -p '%s'", sanitizedPath)
158+
command := fmt.Sprintf("mkdir -p '%s'", fullPath)
176159

177160
output, err := a.runShellCommand(command)
178161
if err != nil {
@@ -183,12 +166,7 @@ func (a *App) CreateFolder(fullPath string) (string, error) {
183166
}
184167

185168
func (a *App) DeleteFile(fullPath string) (string, error) {
186-
if err := ValidateRemotePath(fullPath); err != nil {
187-
return "", fmt.Errorf("invalid path: %w", err)
188-
}
189-
190-
sanitizedPath := SanitizeShellArg(fullPath)
191-
command := fmt.Sprintf("rm -rf '%s'", sanitizedPath)
169+
command := fmt.Sprintf("rm -rf '%s'", fullPath)
192170

193171
output, err := a.runShellCommand(command)
194172
if err != nil {
@@ -199,16 +177,7 @@ func (a *App) DeleteFile(fullPath string) (string, error) {
199177
}
200178

201179
func (a *App) RenameFile(oldPath string, newPath string) (string, error) {
202-
if err := ValidateRemotePath(oldPath); err != nil {
203-
return "", fmt.Errorf("invalid old path: %w", err)
204-
}
205-
if err := ValidateRemotePath(newPath); err != nil {
206-
return "", fmt.Errorf("invalid new path: %w", err)
207-
}
208-
209-
sanitizedOld := SanitizeShellArg(oldPath)
210-
sanitizedNew := SanitizeShellArg(newPath)
211-
command := fmt.Sprintf("mv '%s' '%s'", sanitizedOld, sanitizedNew)
180+
command := fmt.Sprintf("mv '%s' '%s'", oldPath, newPath)
212181

213182
output, err := a.runShellCommand(command)
214183
if err != nil {

‎backend/package_service.go‎

Lines changed: 6 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,7 @@ import (
99
)
1010

1111
func (a *App) InstallPackage(filePath string) (string, error) {
12-
if err := ValidateFilePath(filePath); err != nil {
13-
return "", fmt.Errorf("invalid file path: %w", err)
14-
}
12+
1513

1614
a.opMutex.Lock()
1715
ctx, cancel := context.WithTimeout(context.Background(), 15*time.Minute)
@@ -39,9 +37,7 @@ func (a *App) InstallPackage(filePath string) (string, error) {
3937
}
4038

4139
func (a *App) UninstallPackage(packageName string) (string, error) {
42-
if err := ValidatePackageName(packageName); err != nil {
43-
return "", fmt.Errorf("invalid package name: %w", err)
44-
}
40+
4541

4642
output, err := a.runCommand("adb", "shell", "pm", "uninstall", packageName)
4743
if err != nil {
@@ -164,9 +160,7 @@ func (a *App) ListPackages(filterType string) ([]PackageInfo, error) {
164160

165161

166162
func (a *App) ClearData(packageName string) (string, error) {
167-
if err := ValidatePackageName(packageName); err != nil {
168-
return "", fmt.Errorf("invalid package name: %w", err)
169-
}
163+
170164

171165
output, err := a.runCommand("adb", "shell", "pm", "clear", packageName)
172166

@@ -182,9 +176,7 @@ func (a *App) ClearData(packageName string) (string, error) {
182176
}
183177

184178
func (a *App) DisablePackage(packageName string) (string, error) {
185-
if err := ValidatePackageName(packageName); err != nil {
186-
return "", fmt.Errorf("invalid package name: %w", err)
187-
}
179+
188180

189181
output, err := a.runCommand("adb", "shell", "pm", "disable-user", "--user", "0", packageName)
190182
if err != nil {
@@ -203,9 +195,7 @@ func (a *App) DisablePackage(packageName string) (string, error) {
203195
}
204196

205197
func (a *App) EnablePackage(packageName string) (string, error) {
206-
if err := ValidatePackageName(packageName); err != nil {
207-
return "", fmt.Errorf("invalid package name: %w", err)
208-
}
198+
209199

210200
output, err := a.runCommand("adb", "shell", "pm", "enable", "--user", "0", packageName)
211201
if err != nil {
@@ -220,9 +210,7 @@ func (a *App) EnablePackage(packageName string) (string, error) {
220210
}
221211

222212
func (a *App) PullApk(packageName string) (string, error) {
223-
if err := ValidatePackageName(packageName); err != nil {
224-
return "", fmt.Errorf("invalid package name: %w", err)
225-
}
213+
226214

227215
pathOutput, err := a.runCommand("adb", "shell", "pm", "path", packageName)
228216
if err != nil {

0 commit comments

Comments
 (0)