bamaer opened a new issue, #8311: URL: https://github.com/apache/hop/issues/8311
### What needs to happen? `GPG.execGnuPG()` builds a command string and runs it through a shell (`/bin/sh -c` on POSIX, `Runtime.exec(String)` on Windows) — `GPG.java:160-176`. Callers concatenate filenames, key IDs and the passphrase into that string wrapped in double quotes, which do not prevent shell expansion. Filenames come from a directory scan (`ActionPGPEncryptFiles.java:621`), so their content is interpreted rather than passed to GnuPG literally. Change `execGnuPG` to take a `List<String>` and use `new ProcessBuilder(command).start()` with no shell. The ten call sites in the same file drop their quote concatenation; `gnuPGCommand` (`"--batch --armor "`) becomes two list elements. Same code path, worth fixing together: `decryptFile()` passes the passphrase on argv via `--passphrase` (readable in the process table) and the debug log at line 165 logs it. Both go away by using `--passphrase-fd 0`, already used elsewhere in the class. No public API or metadata change — `execGnuPG` is private and the public signatures stay as they are. ### Issue Priority Priority: 2 ### Issue Component Component: Actions -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
