fixed string escaping security issue

src/main.js

@@ -58,18 +58,21 @@ async function run() {
     // Run following script before running this action
     // npm run render_ejs
     // audit script will install auditd and set up audit rules
-    const { auditScript } = require('./generated/audit-sh')
-    fs.writeFileSync('audit.sh', auditScript())
+    const { auditScriptBase64 } = require('./generated/audit-sh')
+    const auditScript = Buffer.from(auditScriptBase64(), 'base64').toString()
+    fs.writeFileSync('audit.sh', auditScript)
 
     const { auditRulesTemplate } = require('./audit_rules')
 
     // createBoltUserScript will create a new user for running bolt
-    const { createBoltUserScript } = require('./generated/create-bolt-user-sh')
-    fs.writeFileSync('create-bolt-user.sh', createBoltUserScript())
+    const { createBoltUserScriptBase64 } = require('./generated/create-bolt-user-sh')
+    const createBoltUserScript = Buffer.from(createBoltUserScriptBase64(), 'base64').toString()
+    fs.writeFileSync('create-bolt-user.sh', createBoltUserScript)
 
     // iptablesScript will set up iptables rules
-    const { iptablesScript } = require('./generated/iptables-sh')
-    fs.writeFileSync('iptables.sh', iptablesScript())
+    const { iptablesScriptBase64 } = require('./generated/iptables-sh')
+    const iptablesScript = Buffer.from(iptablesScriptBase64(), 'base64').toString()
+    fs.writeFileSync('iptables.sh', iptablesScript)
 
     const mode = getMode()
     const allowHTTP = getAllowHTTP()

src/wrappers/wrapper.ejs

@@ -1,7 +1,7 @@
-const <%= name %> = () => {
-  return `<%- body.replace(/`/g, '\\`') %>`
+const <%= name %>Base64 = () => {
+  return '<%- Buffer.from(body).toString('base64') %>'
 }
 
 module.exports = {
-  <%= name %>
+  <%= name %>Base64
 }