fix(security): escape shell arg single quotes

Author: killagu

plugins/security/README.md

@@ -440,7 +440,9 @@ cp.exec('bash /home/admin/ali-knowledge-graph-backend/initrun.sh ' + ctx.helper.
 
 ### .escapeShellArg()
 
-Escape command line arguments. Add single quotes around a string and quotes/escapes any existing single quotes allowing you to pass a string directly to a shell function and having it be treated as a single safe argument.
+Escape POSIX shell command line arguments. Add single quotes around a string and quotes/escapes any existing single quotes allowing you to pass a string directly to a shell function and having it be treated as a single safe argument.
+
+Prefer `child_process.execFile()` or `child_process.spawn()` with an arguments array when possible. This helper is for a single argument in a POSIX shell command string, and is not a Windows `cmd.exe` or PowerShell escaping helper.
 
 ```js
 const ip = '127.0.0.1 && cat /etc/passwd';

plugins/security/README.zh-CN.md

@@ -358,7 +358,9 @@ cp.exec('bash /home/admin/ali-knowledge-graph-backend/initrun.sh ' + this.helper
 
 ### .escapeShellArg()
 
-命令行参数转义。给字符串增加一对单引号并且能引用或者转码任何已经存在的单引号， 这样以确保能够直接将一个字符串传入 shell 函数，并且还是确保安全的。
+POSIX shell 命令行参数转义。给字符串增加一对单引号并且能引用或者转码任何已经存在的单引号， 这样以确保能够直接将一个字符串传入 shell 函数，并且还是确保安全的。
+
+如果可以，优先使用 `child_process.execFile()` 或 `child_process.spawn()` 的参数数组。这个 helper 只用于 POSIX shell 命令字符串里的单个参数，不适用于 Windows `cmd.exe` 或 PowerShell 转义。
 
 ```js
 const ip = '127.0.0.1 && cat /etc/passwd';

plugins/security/src/lib/helper/escapeShellArg.ts

@@ -1,4 +1,4 @@
 export default function escapeShellArg(text: string): string {
   const str = '' + text;
-  return "'" + str.replace(/\\/g, '\\\\').replace(/'/g, "\\'") + "'";
+  return "'" + str.replace(/'/g, "'\\''") + "'";
 }

plugins/security/test/app/extends/escapeShellArg.test.ts

@@ -1,8 +1,15 @@
+import { exec as childProcessExec } from 'node:child_process';
+import { promisify } from 'node:util';
+
 import { mm, type MockApplication } from '@eggjs/mock';
-import { beforeAll, afterAll, describe, it } from 'vitest';
+import { beforeAll, afterAll, describe, expect, it } from 'vitest';
 
+import escapeShellArg from '../../../src/lib/helper/escapeShellArg.ts';
 import { getFixtures } from '../../utils.ts';
 
+const exec = promisify(childProcessExec);
+const itOnPosix = process.platform === 'win32' ? it.skip : it;
+
 describe('test/app/extends/escapeShellArg.test.ts', () => {
   let app: MockApplication;
   beforeAll(async () => {
@@ -26,5 +33,12 @@ describe('test/app/extends/escapeShellArg.test.ts', () => {
     it('should not affect normal arg', () => {
       return app.httpRequest().get('/escapeShellArg-3').expect(200).expect('true');
     });
+
+    itOnPosix('should keep single quotes inside one shell argument', async () => {
+      const payload = "'; echo EGG_SECURITY_INJECTED; #";
+      const { stdout } = await exec(`printf 'ARG:%s\\n' ${escapeShellArg(payload)}`);
+
+      expect(stdout).toBe("ARG:'; echo EGG_SECURITY_INJECTED; #\n");
+    });
   });
 });

plugins/security/test/fixtures/apps/helper-escapeShellArg-app/app/router.js

@@ -10,7 +10,7 @@ module.exports = (app) => {
     const port = "8889'|chmod 777 /tmp/muma.sh;echo \\";
     this.body =
       `cp.exec('./start.sh '+${this.helper.escapeShellArg(port)})` ===
-      "cp.exec('./start.sh '+'8889\\'|chmod 777 /tmp/muma.sh;echo \\\\')";
+      "cp.exec('./start.sh '+'8889'\\''|chmod 777 /tmp/muma.sh;echo \\')";
   });
 
   app.get('/escapeShellArg-3', async function () {