Control: severity -1 important Control: retitle -1 debci: must sanitize or escape triggers for command line use Control: tags -1 patch Control: forwarded -1 https://salsa.debian.org/ci-team/debci/merge_requests/18
On Mon, 25 Jun 2018 09:58:38 +0200 Paul Gevers <[email protected]> wrote: > Just to have this documented, the results web page of a package doesn't > show the full trigger if it contains a space character, but only shows > up to the first space. This is not a problem on the pending page, and I > believe the results json from the API is also OK. The underlying problem is that the string is in the output from the amqp queue and it is not escaped there. So not only do the results show up wrongly, but this also enables authenticated users to inject arbitrary commands (which are run as the debci user). Paul
signature.asc
Description: OpenPGP digital signature
