Escape GraphViz command before calling proc_open()

Fixes #26162, CVE-2019-15715 (cherry picked from commit 5fb9796)
mantisbt · Sep 21, 2019 · cebfb9a · cebfb9a
1 parent 7092573
commit cebfb9a
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/core/graphviz_api.php b/core/graphviz_api.php
@@ -352,7 +352,7 @@ function output( $p_format = 'dot', $p_headers = false ) {
 
 		# Start dot process
 
-		$t_command = $this->graphviz_tool . ' -T' . $p_format;
+		$t_command = escapeshellcmd( $this->graphviz_tool . ' -T' . $p_format );
 		$t_descriptors = array(
 			0 => array( 'pipe', 'r', ),
 			1 => array( 'pipe', 'w', ),