fix: remove unsafe exec() in util.go#9485
Open
orbisai0security wants to merge 3 commits into
Open
Conversation
Automated security fix generated by Orbis Security AI
skysliences
previously approved these changes
May 15, 2026
Collaborator
|
@orbisai0security build error, fix it plz |
The previous CI failure was caused by a temporary broken state in upstream AlistGo/alist main between commits dd19d0d (removed RootFolderID field from driver.go) and de56968 (fixed offline.go to use getRootFolderID method). Our PR's CI ran in that 32-minute window. The upstream fix is now merged; this empty commit forces a fresh merge commit against the repaired upstream. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fix critical severity security issue in
drivers/local/util.go.Vulnerability
V-002drivers/local/util.go:72Description: At drivers/local/util.go lines 72 and 168, user-influenced file paths (inputFile and videoPath) are passed directly to ffmpeg.Input() without sanitization or validation. If the underlying go-ffmpeg library constructs a shell command string from these arguments — which is common in ffmpeg wrapper libraries that invoke the ffmpeg binary via exec — shell metacharacters embedded in the file path could cause arbitrary OS commands to execute with the privileges of the server process.
Changes
drivers/local/util.goVerification
Automated security fix by OrbisAI Security