[FIX] #204782 【KVE】peony-extensions KVE-2023-1201

peony-share/service/samba-config.cpp

@@ -28,6 +28,8 @@
 #include <syslog.h>
 #include <QFile>
 
+#include <pwd.h>
+
 class SambaConfigPrivate
 {
 public:
@@ -334,6 +336,20 @@ bool SambaConfig::init(QString name, int pid, int uid)
         return false;
     }
 
+    // KVE-2023-1201
+    if (name.contains("|"))
+        return false;
+    QStringList allUsers;
+    struct passwd *pw;
+    setpwent();
+    while ((pw = getpwent()) != nullptr) {
+        allUsers << pw->pw_name;
+    }
+    endpwent();
+    if (!allUsers.contains(name)) {
+        return false;
+    }
+
     if (d->mLock.tryLock(300)) {
         d->mUserName = name;
         d->mUserPid = pid;