From 4b22871ab4aecfdc35630c11abf2f5c2d5c710b5 Mon Sep 17 00:00:00 2001 From: Shihaam Abdul Rahman Date: Fri, 13 Mar 2026 00:24:50 +0500 Subject: [PATCH] disable logcat on release builds, add shellexcape prevention fun --- .../main/java/sh/sar/isodroid/root/RootManager.kt | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/app/src/main/java/sh/sar/isodroid/root/RootManager.kt b/app/src/main/java/sh/sar/isodroid/root/RootManager.kt index e159616..e2b818b 100644 --- a/app/src/main/java/sh/sar/isodroid/root/RootManager.kt +++ b/app/src/main/java/sh/sar/isodroid/root/RootManager.kt @@ -6,13 +6,26 @@ package sh.sar.isodroid.root import com.topjohnwu.superuser.Shell +import sh.sar.isodroid.BuildConfig import kotlinx.coroutines.Dispatchers import kotlinx.coroutines.withContext object RootManager { + /** + * Escapes a string for safe use in shell commands. + * Uses single quotes and escapes any single quotes within the string. + * This prevents command injection via $(), ``, ;, &&, ||, etc. + */ + fun shellEscape(s: String): String { + // Single quotes prevent all shell interpretation except for single quotes themselves + // To include a single quote, we end the single-quoted string, add an escaped single quote, and start a new single-quoted string + // Example: "test'file" becomes 'test'\''file' + return "'" + s.replace("'", "'\\''") + "'" + } + init { - Shell.enableVerboseLogging = true + Shell.enableVerboseLogging = BuildConfig.DEBUG Shell.setDefaultBuilder( Shell.Builder.create() .setFlags(Shell.FLAG_MOUNT_MASTER or Shell.FLAG_REDIRECT_STDERR)