procyberian/emacs
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix ruby-mode.el local command injection vulnerability (bug#60268)

Browse source 
* lisp/progmodes/ruby-mode.el
(ruby-find-library-file): Fix local command injection vulnerability.

(cherry picked from commit 9a3b08061f)
This commit is contained in:
Xi Lu 2022-12-23 12:52:48 +08:00 • committed by Stefan Kangas
parent 807d2d5b3a
commit 22fb5ff512
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
lisp/progmodes/ruby-mode.el
View file

@ -1819,7 +1819,7 @@ or `gem' statement around point."
(setq feature-name (read-string "Feature name: " init))))
(let ((out
(substring
(shell-command-to-string (concat "gem which " feature-name))
(shell-command-to-string (concat "gem which " (shell-quote-argument feature-name)))
0 -1)))
(if (string-match-p "\\`ERROR" out)
(user-error "%s" out)