PHXH
/
unity-mcp
51
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

sec(installer): escape server path in pgrep pattern to prevent injection/regex issues

main
David Sarno 2025-08-24 09:46:54 -07:00
parent 175d5ae150
commit 742d168b51
1 changed files with 22 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
UnityMcpBridge/Editor/Helpers/ServerInstaller.cs
View File

@ -368,10 +368,11 @@ namespace MCPForUnity.Editor.Helpers
if (string.IsNullOrEmpty(serverSrcPath)) return;
if (RuntimeInformation.IsOSPlatform(OSPlatform.Windows)) return;
string safePath = EscapeForPgrep(serverSrcPath);
var psi = new System.Diagnostics.ProcessStartInfo
{
FileName = "/usr/bin/pgrep",
Arguments = $"-f \"uv .*--directory {serverSrcPath}\"",
Arguments = $"-f \"uv .*--directory {safePath}\"",
UseShellExecute = false,
RedirectStandardOutput = true,
RedirectStandardError = true,
@ -406,6 +407,26 @@ namespace MCPForUnity.Editor.Helpers
catch { return null; }
}
// Escape regex metacharacters so the path is treated literally by pgrep -f
private static string EscapeForPgrep(string path)
{
if (string.IsNullOrEmpty(path)) return path;
// Escape backslash first, then regex metacharacters
string s = path.Replace("\\", "\\\\");
char[] meta = new[] {'.','+','*','?','^','$','(',')','[',']','{','}','|'};
var sb = new StringBuilder(s.Length * 2);
foreach (char c in s)
{
if (Array.IndexOf(meta, c) >= 0)
{
sb.Append('\\');
}
sb.Append(c);
}
// Also escape double quotes which we wrap the pattern with
return sb.ToString().Replace("\"", "\\\"");
}
private static int CompareSemverSafe(string a, string b)
{
try