path: root/send-pack.c
diff options
authorJunio C Hamano <>2005-07-08 07:02:52 (GMT)
committerLinus Torvalds <>2005-07-08 18:01:10 (GMT)
commitb10d0ec7321a6bd6cc1a62f44fee305a0d184dca (patch)
tree35c8f091000fc8ff32e60d6a530d8d650c874c66 /send-pack.c
parent6fb737be5e4803feabe0d1b6169de36131936368 (diff)
[PATCH] Use sq_quote() to properly quote the parameter to call shell.
This tries to be more lenient to the users and stricter to the attackers by quoting the input properly for shell safety, instead of forbidding certain characters from the input. Things to note: - We do not quote "prog" parameter (which comes from --exec). The user should know what he is doing. --exec='echo foo' will supply the first two parameters to the resulting command, while --exec="'echo foo'" will give the first parameter, a single string with a space inside. - We do not care too much about leaking the sq_quote() output just before running exec(). Signed-off-by: Junio C Hamano <> Signed-off-by: Linus Torvalds <>
Diffstat (limited to 'send-pack.c')
0 files changed, 0 insertions, 0 deletions