Fix security issue with git grep -O

gollum · Dec 4, 2014 · 4520d97 · dometto · Dec 4, 2014 · 4520d97
1 parent 1b04ba5
commit 4520d97
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/lib/grit_adapter/git_layer_grit.rb b/lib/grit_adapter/git_layer_grit.rb
@@ -136,6 +136,8 @@ def exist?
 
       def grep(query, options={})
         ref = options[:ref] ? options[:ref] : "HEAD"
+        query = Shellwords.split(query).select {|q| !(q =~ /^(-O)|(--open-files-in-pager)/) }
+        query = Shellwords.join(query)
         args = [{}, '-I', '-i', '-c', query, ref, '--']
         args << options[:path] if options[:path]
         result = @git.grep(*args).split("\n")
@@ -165,6 +167,7 @@ def rev_list(options, *refs)
 
       def ls_files(query, options = {})
         options[:ref] = options[:ref] ? options[:ref] : "HEAD"
+        query = Shellwords.shellescape(query)
         @git.ls_files({}, "*#{query}*").split("\n")
       end