Added CommandInjectionChecker for checking for command injection #2276
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
PR Description:
The CommandInjectionChecker is a ServiceNow Script Include designed to detect potential command injection attacks in user-supplied strings. It scans for common shell metacharacters and patterns (e.g., ;, |, &, $(), `) using regex, providing a boolean result to flag suspicious inputs. This utility enhances security in server-side automation without relying on external libraries, following ServiceNow best practices for input validation.
Example on how to use it:
var checker = new CommandInjectionChecker();
// Safe input
if (!checker.containsCommandInjection('Normal text')) {
gs.info('Input is clean.');
}
// Suspicious input
if (checker.containsCommandInjection('ls; rm -rf /')) {
gs.error('Command injection detected - blocking action.');
}
Pull Request Checklist
Overview
Code Quality
Repository Structure Compliance
Core ServiceNow APIs/Server-Side Components/Client-Side Components/Modern Development/Integration/Specialized Areas/Documentation
Restrictions