patch CVE-2020-13619

[divinity76]

fixes #420

• Have you followed the guidelines in our Contributing document?
• Have you checked to ensure there aren't other open Pull Requests for the same update/change?

Description

see #420

(also it's technically possible to create a smaller command with the same data, \'\' and ''\'''\''' compiles to the exact same string, but given the security-sensitive aspect if we get the optimization wrong, and the fact that even the php core developers didn't try to optimize this part, we probably shouldn't try to do that either. i suspect it was such an optimization gone wrong that lead to CVE-2020-13619 in the first place.)

[kvz]

Thank you! Merged and released as locutus@2.0.13

[divinity76]

@kvz thanks,

and while i got your attention, know that PR #425 and PR #424 is about the same function, but separate issues to this PR, and not withdrawn ^^

[kvz]

Appreciated, will check them out 👍

[divinity76]

https://locutus.io/php/exec/escapeshellarg/ still displays the vulnerable version, can someone fix that?

ping @kvz wouldn't surprise me if you're the web admin

[kvz]

Hey, thanks, I fixed some issues and the website should be updated

[divinity76]

@kvz hmm, at 2020-11-19T15:09:19+00:00 it's still displaying the vulnerable version

[kvz]

Ah thanks for catching, fixed for real now!