fix: harden local command execution and SNI error handling
Use argument-based child process execution in the shadcn update script to avoid shell interpolation risks and add a nil-safe close fallback in SNI inspection error paths to prevent panics. Made-with: Cursor
fr4iser committed
Mar 24, 2026 at 11:41 UTC
7eca332200de5beb69ad721024f9314517f61eb9
2 files changed
+16
-5
frontend/update-shadcn.cjs
+11
-4
@@ -2,7 +2,7 @@
2
3
const fs = require("fs");
4
const path = require("path");
5
-const { execSync } = require("child_process");
5
+const { execFileSync } = require("child_process");
6
7
/**
8
* shadcn 컴포넌트를 자동으로 업데이트하는 스크립트
@@ -69,12 +69,19 @@ function main() {
69
try {
70
console.log(`🔄 업데이트 중: ${componentName}...`);
71
72
- const command = `npx shadcn@latest add -o -y ${componentName}`;
73
- execSync(command, {
72
+ if (!/^[a-z0-9_-]+$/i.test(componentName)) {
73
+ throw new Error(`invalid component name: ${componentName}`);
74
+ }
75
+
76
+ execFileSync(
77
+ "npx",
78
+ ["shadcn@latest", "add", "-o", "-y", componentName],
79
+ {
80
stdio: "pipe",
81
encoding: "utf8",
82
env: { ...process.env, npm_config_legacy_peer_deps: "true" },
77
- });
83
+ }
84
+ );
85
86
console.log(`✅ ${componentName} 업데이트 완료`);
87
successCount++;
portal/server.go
+5
-1
@@ -396,7 +396,11 @@ func (s *Server) runSNIListener(ctx context.Context) error {
396
func (s *Server) handleSNIConn(ctx context.Context, conn net.Conn) {
397
clientHello, wrappedConn, err := l4.InspectClientHello(conn, s.cfg.ClientHelloTimeout)
398
if err != nil {
399
- _ = wrappedConn.Close()
399
+ if wrappedConn != nil {
400
+ _ = wrappedConn.Close()
401
+ } else {
402
+ _ = conn.Close()
403
+ }
404
return
405
}
406