mirror/emacs
1
0
Fork 0
mirror of https://git.savannah.gnu.org/git/emacs.git synced 2024-11-23 07:19:15 +00:00
Code Issues Releases Activity

Fix ruby-mode.el local command injection vulnerability (bug#60268)

Browse Source 
* lisp/progmodes/ruby-mode.el
(ruby-find-library-file): Fix local command injection vulnerability.

(cherry picked from commit 9a3b08061f)
This commit is contained in:
Xi Lu 2022-12-23 12:52:48 +08:00 committed by Stefan Kangas
parent 807d2d5b3a
commit 22fb5ff512
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
lisp/progmodes/ruby-mode.el
View File

@ -1819,7 +1819,7 @@ or `gem' statement around point."
(setq feature-name (read-string "Feature name: " init))))
(let ((out
(substring
(shell-command-to-string (concat "gem which " feature-name))
(shell-command-to-string (concat "gem which " (shell-quote-argument feature-name)))
0 -1)))
(if (string-match-p "\\`ERROR" out)
(user-error "%s" out)