mirror of
https://github.com/opensourcepos/opensourcepos.git
synced 2026-11-09 07:53:29 -05:00
jekkosandobjecttothis
260483d436
The valid_path_strict() regex previously allowed space characters, permitting values like '/bin/sh -c id' to pass validation. When passed to CodeIgniter's popen() sink, the shell interprets the space as an argument separator, enabling arbitrary command execution. Remove space from the allowed character set. Legitimate sendmail paths (/usr/sbin/sendmail, C:\wamp64\bin\sendmail\sendmail.exe) do not contain spaces. Update existing tests and add regression cases for shell -c payloads. --------- Co-authored-by: objecttothis <17935339+objecttothis@users.noreply.github.com>