mirror/flatpak
1
0
Fork 0
mirror of https://github.com/flatpak/flatpak.git synced 2026-01-28 01:28:15 -05:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #194 from smcv/shell-injection

Browse Source 
unrpm: prevent shell injection
This commit is contained in:
Alexander Larsson
2016-08-26 11:19:34 +02:00
committed by GitHub
parent fcd91ad6db 5b8fdb4998
commit 07fa8138a2
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
builder/builder-source-archive.c
View File

@@ -416,12 +416,12 @@ unrpm (GFile *dir,
GError **error)
{
gboolean res;
const gchar *argv[] = { "sh", "-c", NULL, NULL };
char *unrpm_cmdline = g_strdup_printf("rpm2cpio %s | cpio -i -d", rpm_path);
const gchar *argv[] = { "sh", "-c", "rpm2cpio \"$1\" | cpio -i -d",
"sh", /* shell's $0 */
rpm_path, /* shell's $1 */
NULL };
argv[2] = unrpm_cmdline;
res = flatpak_spawnv (dir, NULL, error, argv);
g_free(unrpm_cmdline);
return res;
}