Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[HOTFIX] Escape envs when using .conf interpreter #4715

Merged
merged 1 commit into from Feb 27, 2024

Conversation

jongyoul
Copy link
Member

What is this PR for?

Escaping envs to avoid malicious code in envs

What type of PR is it?

Hot Fix

Todos

  • - Task

What is the Jira issue?

N/A

How should this be tested?

  • Add shell commends inside envs
  • It shouldn't be executed

Screenshots (if appropriate)

Questions:

  • Does the license files need to update? No
  • Is there breaking changes for older versions? No
  • Does this needs documentation? No

@jongyoul
Copy link
Member Author

ping @zjffdu @Reamer @huage1994
This code will change some malicious code like

$ printf %q ';whoami > /tmp/imp.log; date >>/tmp/imp.log;'
\;whoami\ \>\ /tmp/imp.log\;\ date\ \>\>/tmp/imp.log\;%

@jongyoul jongyoul merged commit dd08a39 into apache:master Feb 27, 2024
31 checks passed
jongyoul added a commit that referenced this pull request Mar 17, 2024
@jongyoul jongyoul changed the title [HOTFIX] Escape envs when using .conf [HOTFIX] Escape envs when using .conf interpreter Apr 8, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
2 participants