Merge pull request #45 from 418sec/master

huntr.dev - Command Injection Fix
kylefarris · May 1, 2020 · 5f557c9 · 5f557c9
2 parents d474da7 + 8081928
commit 5f557c9
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/index.js b/index.js
@@ -491,8 +491,8 @@ class NodeClam {
 
         try {
             await fs_access(path, fs.constants.R_OK);
-
-            const {stdout} = await cp_exec(version_cmds[scanner]);
+            version_cmds_exec = version_cmds[scanner].split(' ');
+            const {stdout} = await cp_execfile(version_cmds_exec[0], [version_cmds_exec[1]]);
             if (stdout.toString().match(/ClamAV/) === null) {
                 if (this.settings.debug_mode) console.log(`${this.debug_label}: Could not verify the ${scanner} binary.`);
                 return false;