Skip to content

security fixes #75

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
anurag3301 merged 2 commits into from
Sep 8, 2026
Merged

security fixes #75

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d157427
Making insecure=true for curl.get conditional based on OS
anurag3301 Sep 8, 2026
c33dad1
Added sanitize_shell_arg to prevent any possiblity of command injecti…
anurag3301 Sep 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion lua/platformio/pioinit.lua
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,9 @@ local function init_project(board_details, selected_framework)
if framework == 'none' then
framework = ''
end
local command = 'pio project init --board ' .. board_details.id .. ' --project-option "framework=' .. framework .. '"'
local board_id = utils.sanitize_shell_arg(board_details.id)
local framework_arg = utils.sanitize_shell_arg(framework)
local command = 'pio project init --board ' .. board_id .. ' --project-option "framework=' .. framework_arg .. '"'
utils.ToggleTerminal(command, 'float', function()
vim.cmd(':PioLSP')
boilerplate_gen(framework)
Expand Down
6 changes: 3 additions & 3 deletions lua/platformio/piolib.lua
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ function M.piolib(lib_arg_list)

local url = 'https://api.registry.platformio.org/v3/search'
local res = curl.get(url, {
insecure = true,
insecure = utils.is_windows, -- Windows curl builds often lack a CA bundle, breaking TLS verification
timeout = 20000,
headers = { content_type = 'application/json' },
query = {
Expand All @@ -32,8 +32,8 @@ function M.piolib(lib_arg_list)
if res['status'] == 200 then
local json_data = vim.json.decode(res['body'])
picker.pick_library(json_data.items or {}, function(selected_library)
local owner = (selected_library.owner and selected_library.owner.username) or ''
local name = selected_library.name or ''
local owner = utils.sanitize_shell_arg((selected_library.owner and selected_library.owner.username) or '')
local name = utils.sanitize_shell_arg(selected_library.name or '')
if owner == '' or name == '' then
vim.notify('Invalid library selection: missing owner or name.', vim.log.levels.ERROR)
return
Expand Down
10 changes: 7 additions & 3 deletions lua/platformio/utils.lua
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,15 +19,19 @@ function M.check_prefix(str, prefix)
return str:sub(1, #prefix) == prefix
end

function M.sanitize_shell_arg(str)
return (str or ''):gsub('[^%w%.%-_/]', '')
end

------------------------------------------------------
local is_windows = jit.os == 'Windows'
M.is_windows = jit.os == 'Windows'

M.devNul = is_windows and ' 2>./nul' or ' 2>/dev/null'
M.devNul = M.is_windows and ' 2>./nul' or ' 2>/dev/null'

-- INFO: get current OS enter
function M.enter()
local shell = vim.o.shell
if is_windows then
if M.is_windows then
return vim.fn.executable('pwsh') and '\r' or '\r\n'
elseif shell:find('nu') then
return '\r'
Expand Down
Loading