You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Unfortunately that command is not properly escapend, since if a library happens to include a quote, it basically allows "shell injection".
Moreover the deploy_path doesn't seem to be quoted at all.
(Granted, it is very unlikely that a library contains "strange" characters, like say libunsafe"; rm -Rf .;.so, however a tool should be safe regardless.)
The text was updated successfully, but these errors were encountered:
At the moment, when invoking
chrpath
orstrip
, the tool seems to be usingpopen
, which underneath just callssystem
with a command as a string.Unfortunately that command is not properly escapend, since if a library happens to include a quote, it basically allows "shell injection".
Moreover the
deploy_path
doesn't seem to be quoted at all.(Granted, it is very unlikely that a library contains "strange" characters, like say
libunsafe"; rm -Rf .;.so
, however a tool should be safe regardless.)The text was updated successfully, but these errors were encountered: