mirror of
https://gitea.quitesimple.org/crtxcr/cgitsb
synced 2024-11-23 12:42:19 +01:00
7ea35f9f8e
By not quoting the argument, an attacker with the ability to add files to the repository could pass arbitrary arguments to the highlight command, in particular, the --plug-in argument which can lead to arbitrary command execution. This patch adds simple argument quoting. |
||
---|---|---|
.. | ||
commit-links.sh | ||
syntax-highlighting.sh |