mirror of
https://github.com/Cisco-Talos/clamav.git
synced 2026-07-30 08:58:26 -04:00
412fd53fb1
VirusEvent executes the configured command through /bin/sh -c. It previously expanded %v by appending the detection name directly into that command string, matching the older behavior for virus-name substitution. Loaded signature names are treated as trusted database content rather than attacker-controlled scanned-file input, so this change is intended as hardening. Still, replacing the shell interpolation avoids a footgun for deployments that load custom signatures and use VirusEvent. Match the existing %f behavior by replacing %v with a disabled-feature message instead of the virus name. The virus name remains available to VirusEvent scripts through CLAM_VIRUSEVENT_VIRUSNAME. Update the clamd configuration help, sample config, manpage source, and VirusEvent unit test to cover the environment-variable path. Credit: Yazdan Soltani Credit: Nir Yehoshua CLAM-2992