command injection is available

[nyasukun]

put following command line in chat window;
/docker pull ;xxxx

xxxx can be executed in dockercraft server side.

[dave-tucker]

@nyasukun thanks for the report, but I can't seem to replicate the issue.
I've run /docker pull;echo "malicious code" > /go/foo.txt from the client, but that file doesn't appear on the server.
Can you suggest another example I can try?

[aduermael]

@nyasukun @dave-tucker I'm currently working on fixing #12, commands won't be transmitted the same way after that. But we should keep that issue open, we will still have to take care of possible command injection.

[nyasukun]

@dave-tucker plugin checks if docker command by looking 2nd arg. and command line is created with plus joined string.
so command should be /docker pull<space>;<some_single_command> to reproduce.

This issue is cased from using shell to contact with goproxy.
As @aduermael works, it seems to bypass a shell and this issue will be fixed automatically.

Thanks