7ea35f9f8e
By not quoting the argument, an attacker with the ability to add files to the repository could pass arbitrary arguments to the highlight command, in particular, the --plug-in argument which can lead to arbitrary command execution. This patch adds simple argument quoting. |
||
---|---|---|
.. | ||
commit-links.sh | ||
syntax-highlighting.sh |