Fix security risk #1285
Merged
Fix security risk #1285
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Also - print both out and err when ffmpeg fails - use create_subprocess_exec and pass arguments
aklajnert
approved these changes
May 10, 2021
Escaping filenames in |
Silverarmor
added a commit
that referenced
this pull request
May 25, 2021
Publish v3.6.0 * ignore .cache and other hidden files (#1274) * Bump minimal required python version to 3.6.1 (#1278) * Remove FFmpeg normalization causing "quiet" songs. (#1276) * Saved Songs Download and User Authentication (#1240) * regenerate cassettes (#1290) * Use ffmpeg_path to check for version (#1289) * Skip already downloaded songs before doing youtube search (#1287) * Fix security risk (#1285) * Song matching improvements (#1279) * Artist songs fixes (#1284) * More output formats (#1244) * Bump version number to 3.6.0 * Update .gitignore to remove duplicate cache * docs update (#1293) Co-authored-by: Silverarmor <23619946+Silverarmor@users.noreply.github.com> Co-authored-by: Jakub Kot <42355410+xnetcat@users.noreply.github.com> Co-authored-by: Peyton Creery <44987569+phcreery@users.noreply.github.com> Co-authored-by: AZMCode <adrianozambrana@protonmail.com> Co-authored-by: Aiden Gardner <19619206+aiden2480@users.noreply.github.com> Co-authored-by: Oliver Blanthorn <freedom4cows@gmail.com> Co-authored-by: Andrzej Klajnert <github@aklajnert.pl>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Title
Fix security risk
Description
create_subprocess_shell is a security risk
Related Issue
#1237
Motivation and Context
shlex.quotewasn't working properly so I've decided to use create_subprocess_execHow Has This Been Tested?
tests
Types of Changes
Checklist