mirror of
https://github.com/novatiq/packages.git
synced 2026-07-20 02:33:03 +01:00
9e79e1b668
Since certain characters are dangerous to pass as-is to a sub shell, sanitize the character set and only allow characters that are considered valid for DNS hosts and filter shell escape characters on generic parameters. Disable pathname expansion on RUNPROG evals to disable the shell expanding *, ? and [ in the arguments. Signed-off-by: Karl Vogel <karl.vogel@gmail.com>