You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
If environment variable values being injected contain special characters, notably any of ", ', \, and probably more, shlex gets very confused when we attempt to split the command after injection.
The current flow is:
Inject values
shlex.split
shlex.quote
I think that the correct approach here might simply be to:
If environment variable values being injected contain special characters, notably any of
",',\, and probably more,shlexgets very confused when we attempt to split the command after injection.The current flow is:
shlex.splitshlex.quoteI think that the correct approach here might simply be to:
shlex.split(keeping Add Windows testing and validate command processing #5 in mind)shlex.quote