From 81340f1723d42dc3155de7ede5dedf03796f1fcd Mon Sep 17 00:00:00 2001
From: cntigers <Xiaohu4321@>
Date: Mon, 6 May 2024 15:42:24 +0800
Subject: [PATCH] fix the git url command injection danger(#15873)

---
 .../plugin/task/pytorch/GitProjectManager.java              | 4 ++--
 .../plugin/task/pytorch/PytorchTaskTest.java                | 6 ++++++
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/dolphinscheduler-task-plugin/dolphinscheduler-task-pytorch/src/main/java/org/apache/dolphinscheduler/plugin/task/pytorch/GitProjectManager.java b/dolphinscheduler-task-plugin/dolphinscheduler-task-pytorch/src/main/java/org/apache/dolphinscheduler/plugin/task/pytorch/GitProjectManager.java
index 3189f26920..5f1e815c30 100644
--- a/dolphinscheduler-task-plugin/dolphinscheduler-task-pytorch/src/main/java/org/apache/dolphinscheduler/plugin/task/pytorch/GitProjectManager.java
+++ b/dolphinscheduler-task-plugin/dolphinscheduler-task-pytorch/src/main/java/org/apache/dolphinscheduler/plugin/task/pytorch/GitProjectManager.java
@@ -33,12 +33,12 @@ import lombok.extern.slf4j.Slf4j;
 public class GitProjectManager {
 
     public static final String GIT_PATH_LOCAL = "GIT_PROJECT";
-    private static final Pattern GIT_CHECK_PATTERN = Pattern.compile("^(git@|https?://)");
+    private static final Pattern GIT_CHECK_PATTERN = Pattern.compile("^(git@|https?://)(?![&|])[^&|]+$");
     private String path;
     private String baseDir = ".";
 
     public static boolean isGitPath(String path) {
-        return GIT_CHECK_PATTERN.matcher(path).find();
+        return GIT_CHECK_PATTERN.matcher(path).matches();
     }
 
     public void prepareProject() throws Exception {
diff --git a/dolphinscheduler-task-plugin/dolphinscheduler-task-pytorch/src/test/java/org/apache/dolphinscheduler/plugin/task/pytorch/PytorchTaskTest.java b/dolphinscheduler-task-plugin/dolphinscheduler-task-pytorch/src/test/java/org/apache/dolphinscheduler/plugin/task/pytorch/PytorchTaskTest.java
index c213021607..27fdd7699b 100644
--- a/dolphinscheduler-task-plugin/dolphinscheduler-task-pytorch/src/test/java/org/apache/dolphinscheduler/plugin/task/pytorch/PytorchTaskTest.java
+++ b/dolphinscheduler-task-plugin/dolphinscheduler-task-pytorch/src/test/java/org/apache/dolphinscheduler/plugin/task/pytorch/PytorchTaskTest.java
@@ -72,6 +72,12 @@ public class PytorchTaskTest {
 
     }
 
+    @Test
+    public void testGitProjectUrlInjection(){
+        Assertions.assertFalse(GitProjectManager.isGitPath("git@& cat /etc/passwd >/poc.txt #"));
+        Assertions.assertFalse(GitProjectManager.isGitPath("git@| cat /etc/passwd >/poc.txt #"));
+    }
+
     @Test
     public void testGitProject() {