mirror/flatpak
1
0
Fork 0
mirror of https://github.com/flatpak/flatpak.git synced 2026-05-16 20:56:52 -04:00
Code Issues Packages Projects Releases Wiki Activity

cli-transaction: Escape any special characters in the EOL reason

Browse Source 
CVE-2023-28101, GHSA-h43h-fwqx-mpp8

Signed-off-by: Simon McVittie <smcv@collabora.com>
This commit is contained in:
Simon McVittie
2023-03-15 10:51:16 +00:00
parent 7fe63f2e8f
commit 409e34187d
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
app/flatpak-cli-transaction.c
View File

@@ -755,6 +755,9 @@ print_eol_info_message (FlatpakDir *dir,
}
else if (reason)
{
g_autofree char *escaped_reason = flatpak_escape_string (reason,
FLATPAK_ESCAPE_ALLOW_NEWLINES |
FLATPAK_ESCAPE_DO_NOT_QUOTE);
if (is_pinned)
{
/* Only runtimes can be pinned */
@@ -770,7 +773,7 @@ print_eol_info_message (FlatpakDir *dir,
g_print (_("\nInfo: app %s%s%s branch %s%s%s is end-of-life, with reason:\n"),
on, ref_name, off, on, ref_branch, off);
}
g_print (" %s\n", reason);
g_print (" %s\n", escaped_reason);
}
}