pagure

#5481 Separate options and operands in PagureRepo.log()
Merged by wombelix. Opened by wombelix.
wombelix/pagure fix_security_issue_rhbz2277121_argument_injection  into  master

Download 5481.patch

Prevent the injection of additional options to the Git command-line
by adding the (non-standard) --end-of-option flag before any
user-controlled value. This was reachable from view_history_file().

Fixes: rhbz#2277121, 6a1d002 ("Add a method to run git log using the system's git")
Signed-off-by: Thomas Chauchefoin thomas@chauchefoin.fr

Metadata Update from @wombelix:
- Request assigned

Patch reviewed and validated in Bugzilla. Tests performed locally, all passed.

Pull-Request has been merged by wombelix
Metadata
wombelix
No Tags
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.