mirror of
https://git.zx2c4.com/cgit
synced 2024-12-23 07:31:53 +00:00
7ea35f9f8e
By not quoting the argument, an attacker with the ability to add files to the repository could pass arbitrary arguments to the highlight command, in particular, the --plug-in argument which can lead to arbitrary command execution. This patch adds simple argument quoting. |
||
---|---|---|
.. | ||
commit-links.sh | ||
syntax-highlighting.sh |