Merge pull request #268 from AikidoSec/fix-different-separators-in-command-injection

Adds more shell separators for injection check

Author: bitterpanda63

agent_api/src/main/java/dev/aikido/agent_api/vulnerabilities/shell_injection/ShellSyntaxChecker.java

@@ -10,7 +10,7 @@
 public final class ShellSyntaxChecker {
     private ShellSyntaxChecker() {}
     private static final List<String> SEPARATORS = Arrays.asList(
-            " ", "\t", "\n", ";", "&", "|", "(", ")", "<", ">"
+            " ", "\t", "\n", ";", "&", "|", "(", ")", "<", ">", "\r", "\f"
     );
 
     public static boolean containsShellSyntax(String command, String userInput) {

agent_api/src/test/java/vulnerabilities/shell_injection/ShellInjectionDetectorTest.java

@@ -434,4 +434,18 @@ void testItFlagsCommaInLoop() {
                 "for (( i=0, j=10; i<j; i++, j-- ))"
         );
     }
+
+    @Test
+    void testCarriageReturnAsSeparator() {
+        // \r (carriage return) as separator before dangerous command
+        assertIsShellInjection("ls\rrm", "rm");
+        assertIsShellInjection("echo test\rrm -rf /", "rm");
+    }
+
+    @Test
+    void testFormFeedAsSeparator() {
+        // \f (form feed) as separator before dangerous command
+        assertIsShellInjection("ls\frm", "rm");
+        assertIsShellInjection("echo test\frm -rf /", "rm");
+    }
 }