Skip to content

Fix PowerShell command injection via unescaped single quotes in file paths #6

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
msarg44 wants to merge 2 commits into
base: M3T4P0D.3XPL01T
Choose a base branch
from
Open

Fix PowerShell command injection via unescaped single quotes in file paths #6

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
86b5cd5
Escape file paths when interpolated into PowerShell commands
msarg44 Aug 22, 2026
7e27ab4
Restore non-executable file mode (no functional change)
msarg44 Aug 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 15 additions & 4 deletions ExploitProtection.PY
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,6 +53,17 @@ def run_powershell(command):
print(f"PS Error: {e}")
return None

def ps_quote(value):
"""Escape a path for safe use inside a single-quoted PowerShell string.

In PowerShell a literal single quote inside a single-quoted string is
escaped by doubling it (''). Paths containing an apostrophe otherwise
break the command or enable command injection via a crafted '; <cmd>; '
sequence.
"""
return value.replace("'", "''")


def update_online_xml():
# Changed from ProgramFiles to Downloads to avoid strict permission issues
dl_folder = os.path.join(os.path.expanduser("~"), "Downloads")
Expand All @@ -69,7 +80,7 @@ def update_online_xml():

if os.path.exists(file_path):
# 1. Try PowerShell Validation
cmd = f"Set-ProcessMitigation -PolicyFilePath '{file_path}' -IsValid"
cmd = f"Set-ProcessMitigation -PolicyFilePath '{ps_quote(file_path)}' -IsValid"
res = run_powershell(cmd)

is_valid = False
Expand All @@ -89,7 +100,7 @@ def update_online_xml():
pass

if is_valid:
run_powershell(f"Set-ProcessMitigation -PolicyFilePath '{file_path}'")
run_powershell(f"Set-ProcessMitigation -PolicyFilePath '{ps_quote(file_path)}'")
messagebox.showinfo("Update completed", "Reboot to finalize protection")
else:
# Include debug info in error
Expand All @@ -112,7 +123,7 @@ def backup_current_settings():
full_path = os.path.join(directory_name, f"{name}.xml")

# Run Backup
cmd = f"Get-ProcessMitigation -RegistryConfigFilePath '{full_path}'"
cmd = f"Get-ProcessMitigation -RegistryConfigFilePath '{ps_quote(full_path)}'"
run_powershell(cmd)

if os.path.exists(full_path):
Expand Down Expand Up @@ -195,7 +206,7 @@ def remove_all_protection():
def import_local_xml():
file_path = filedialog.askopenfilename(title="Select XML File", filetypes=[("XML files", "*.xml")])
if file_path:
cmd = f"Set-ProcessMitigation -PolicyFilePath '{file_path}'"
cmd = f"Set-ProcessMitigation -PolicyFilePath '{ps_quote(file_path)}'"
run_powershell(cmd)
messagebox.showinfo("Reboot to update.", f"Import completed from {file_path}")

Expand Down