From 122edcbcdcd9d4aa6fa486e627acf2eda90b043f Mon Sep 17 00:00:00 2001 From: MaryamArif7 Date: Thu, 25 Jun 2026 13:07:06 +0500 Subject: [PATCH 1/2] fix: replace raw EJS output with escaped output in chaincode templates Signed-off-by: MaryamArif7 --- .../fabric-docker/commands-generated/chaincode-dev-v2.sh | 4 ++-- .../commands-generated/chaincode-install-v2.sh | 6 +++--- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/src/setup-docker/templates/fabric-docker/commands-generated/chaincode-dev-v2.sh b/src/setup-docker/templates/fabric-docker/commands-generated/chaincode-dev-v2.sh index 130691b26..c7e2453ba 100644 --- a/src/setup-docker/templates/fabric-docker/commands-generated/chaincode-dev-v2.sh +++ b/src/setup-docker/templates/fabric-docker/commands-generated/chaincode-dev-v2.sh @@ -13,7 +13,7 @@ "<%= chaincode.name %>" <% -%> "<%= chaincode.version %>" <% -%> "<%= chaincode.channel.ordererHead.fullAddress %>" <% -%> - "<%- chaincode.endorsement || '' %>" <% -%> + "<%= chaincode.endorsement || '' %>" <% -%> "false" <% -%> "" <% -%> "<%= chaincode.privateDataConfigFile || '' %>" <% -%> @@ -28,7 +28,7 @@ chaincodeCommit <% -%> "<%= chaincode.name %>" <% -%> "<%= chaincode.version %>" <% -%> "<%= chaincode.channel.ordererHead.fullAddress %>" <% -%> - "<%- chaincode.endorsement || '' %>" <% -%> + "<%= chaincode.endorsement || '' %>" <% -%> "false" <% -%> "" <% -%> "<%= chaincode.channel.orgs.map((o) => o.headPeer.fullAddress).join(',') %>" <% -%> diff --git a/src/setup-docker/templates/fabric-docker/commands-generated/chaincode-install-v2.sh b/src/setup-docker/templates/fabric-docker/commands-generated/chaincode-install-v2.sh index b44cf4438..f36e11202 100644 --- a/src/setup-docker/templates/fabric-docker/commands-generated/chaincode-install-v2.sh +++ b/src/setup-docker/templates/fabric-docker/commands-generated/chaincode-install-v2.sh @@ -58,7 +58,7 @@ printHeadline "Packaging chaincode '<%= chaincode.name %>'" "U1F60E" "<%= !global.tls ? '' : `crypto-orderer/tlsca.${chaincode.channel.ordererHead.domain}-cert.pem` %>" <% -%> "<%= instance.containerName %>" <% -%> "<%= chaincode.chaincodeMountPath ?? "" %>" <% -%> - "<%- chaincode.chaincodeStartCommand ?? "" %>" + "<%= chaincode.chaincodeStartCommand ?? "" %>" <% } -%> <% }) -%> chaincodeApprove <% -%> @@ -68,7 +68,7 @@ printHeadline "Packaging chaincode '<%= chaincode.name %>'" "U1F60E" "<%= chaincode.name %>" <% -%> "$version" <% -%> "<%= chaincode.channel.ordererHead.fullAddress %>" <% -%> - "<%- chaincode.endorsement || '' %>" <% -%> + "<%= chaincode.endorsement || '' %>" <% -%> "<%= chaincode.initRequired %>" <% -%> "<%= !global.tls ? '' : `crypto-orderer/tlsca.${chaincode.channel.ordererHead.domain}-cert.pem` %>" <% -%> "<%= chaincode.privateDataConfigFile || '' %>" <% -%> @@ -83,7 +83,7 @@ chaincodeCommit <% -%> "<%= chaincode.name %>" <% -%> "$version" <% -%> "<%= chaincode.channel.ordererHead.fullAddress %>" <% -%> - "<%- chaincode.endorsement || '' %>" <% -%> + "<%= chaincode.endorsement || '' %>" <% -%> "<%= chaincode.initRequired %>" <% -%> "<%= !global.tls ? '' : `crypto-orderer/tlsca.${chaincode.channel.ordererHead.domain}-cert.pem` %>" <% -%> "<%= chaincode.channel.orgs.map((o) => o.headPeer.fullAddress).join(',') %>" <% -%> From e12293c9826a713de3b1c9ef06a13f3314418996 Mon Sep 17 00:00:00 2001 From: MaryamArif7 Date: Mon, 29 Jun 2026 12:41:03 +0500 Subject: [PATCH 2/2] fix: use shellQuote helper to prevent shell injection Signed-off-by: MaryamArif7 --- src/setup-docker/index.ts | 6 +++++- .../fabric-docker/commands-generated/chaincode-dev-v2.sh | 4 ++-- .../commands-generated/chaincode-install-v2.sh | 6 +++--- src/utils/shellQuote.ts | 7 +++++++ 4 files changed, 17 insertions(+), 6 deletions(-) create mode 100644 src/utils/shellQuote.ts diff --git a/src/setup-docker/index.ts b/src/setup-docker/index.ts index e8eff1173..30ee7f35c 100644 --- a/src/setup-docker/index.ts +++ b/src/setup-docker/index.ts @@ -3,6 +3,7 @@ import * as config from "../config"; import * as yaml from "js-yaml"; import { getBuildInfo } from "../version/buildUtil"; import parseFabloConfig from "../utils/parseFabloConfig"; +import { shellQuote } from "../utils/shellQuote"; import { ChaincodeConfig, ChannelConfig, @@ -229,7 +230,10 @@ export default class SetupDocker extends Command { for (const script of scripts) { const templatePath = getTemplatePath(this.templatesDir, script); const destPath = getDestinationPath(this.outputDir, script); - await renderTemplate(templatePath, destPath, config as unknown as Record); + await renderTemplate(templatePath, destPath, { + ...(config as unknown as Record), + shellQuote, + }) } } diff --git a/src/setup-docker/templates/fabric-docker/commands-generated/chaincode-dev-v2.sh b/src/setup-docker/templates/fabric-docker/commands-generated/chaincode-dev-v2.sh index c7e2453ba..0d25bd7da 100644 --- a/src/setup-docker/templates/fabric-docker/commands-generated/chaincode-dev-v2.sh +++ b/src/setup-docker/templates/fabric-docker/commands-generated/chaincode-dev-v2.sh @@ -13,7 +13,7 @@ "<%= chaincode.name %>" <% -%> "<%= chaincode.version %>" <% -%> "<%= chaincode.channel.ordererHead.fullAddress %>" <% -%> - "<%= chaincode.endorsement || '' %>" <% -%> + <%- shellQuote(chaincode.endorsement || '') %> <% -%> "false" <% -%> "" <% -%> "<%= chaincode.privateDataConfigFile || '' %>" <% -%> @@ -28,7 +28,7 @@ chaincodeCommit <% -%> "<%= chaincode.name %>" <% -%> "<%= chaincode.version %>" <% -%> "<%= chaincode.channel.ordererHead.fullAddress %>" <% -%> - "<%= chaincode.endorsement || '' %>" <% -%> + <%- shellQuote(chaincode.endorsement || '') %> <% -%> "false" <% -%> "" <% -%> "<%= chaincode.channel.orgs.map((o) => o.headPeer.fullAddress).join(',') %>" <% -%> diff --git a/src/setup-docker/templates/fabric-docker/commands-generated/chaincode-install-v2.sh b/src/setup-docker/templates/fabric-docker/commands-generated/chaincode-install-v2.sh index f36e11202..ffbc701d3 100644 --- a/src/setup-docker/templates/fabric-docker/commands-generated/chaincode-install-v2.sh +++ b/src/setup-docker/templates/fabric-docker/commands-generated/chaincode-install-v2.sh @@ -58,7 +58,7 @@ printHeadline "Packaging chaincode '<%= chaincode.name %>'" "U1F60E" "<%= !global.tls ? '' : `crypto-orderer/tlsca.${chaincode.channel.ordererHead.domain}-cert.pem` %>" <% -%> "<%= instance.containerName %>" <% -%> "<%= chaincode.chaincodeMountPath ?? "" %>" <% -%> - "<%= chaincode.chaincodeStartCommand ?? "" %>" + <%- shellQuote(chaincode.chaincodeStartCommand ?? '') %> <% } -%> <% }) -%> chaincodeApprove <% -%> @@ -68,7 +68,7 @@ printHeadline "Packaging chaincode '<%= chaincode.name %>'" "U1F60E" "<%= chaincode.name %>" <% -%> "$version" <% -%> "<%= chaincode.channel.ordererHead.fullAddress %>" <% -%> - "<%= chaincode.endorsement || '' %>" <% -%> + <%- shellQuote(chaincode.endorsement || '') %> <% -%> "<%= chaincode.initRequired %>" <% -%> "<%= !global.tls ? '' : `crypto-orderer/tlsca.${chaincode.channel.ordererHead.domain}-cert.pem` %>" <% -%> "<%= chaincode.privateDataConfigFile || '' %>" <% -%> @@ -83,7 +83,7 @@ chaincodeCommit <% -%> "<%= chaincode.name %>" <% -%> "$version" <% -%> "<%= chaincode.channel.ordererHead.fullAddress %>" <% -%> - "<%= chaincode.endorsement || '' %>" <% -%> + <%- shellQuote(chaincode.endorsement || '') %> <% -%> "<%= chaincode.initRequired %>" <% -%> "<%= !global.tls ? '' : `crypto-orderer/tlsca.${chaincode.channel.ordererHead.domain}-cert.pem` %>" <% -%> "<%= chaincode.channel.orgs.map((o) => o.headPeer.fullAddress).join(',') %>" <% -%> diff --git a/src/utils/shellQuote.ts b/src/utils/shellQuote.ts new file mode 100644 index 000000000..02a4ce0f1 --- /dev/null +++ b/src/utils/shellQuote.ts @@ -0,0 +1,7 @@ +export function shellQuote(value: unknown): string { + return `"${String(value ?? "") + .replace(/\\/g, "\\\\") + .replace(/"/g, '\\"') + .replace(/\$/g, "\\$") + .replace(/`/g, "\\`")}"`; +} \ No newline at end of file