浏览代码

Remove backticks from author names passed to gnuplot.

Without this, author names containing `touch /tmp/vulnerable` would cause said
file to appear after generating statistics for the given repository.

This is not an optimal solution. Instead of blacklisting characters we should
either whitelist some, or find a safe escape mechanism for gnuplot.
Heikki Hokkanen 12 年前
父节点
当前提交
5ba386aede
共有 1 个文件被更改,包括 4 次插入2 次删除
  1. 4
    2
      gitstats

+ 4
- 2
gitstats 查看文件

1314
 		plots = []
1314
 		plots = []
1315
 		for a in self.authors_to_plot:
1315
 		for a in self.authors_to_plot:
1316
 			i = i + 1
1316
 			i = i + 1
1317
-			plots.append("""'lines_of_code_by_author.dat' using 1:%d title "%s" w lines""" % (i, a.replace("\"", "\\\"")))
1317
+			author = a.replace("\"", "\\\"").replace("`", "")
1318
+			plots.append("""'lines_of_code_by_author.dat' using 1:%d title "%s" w lines""" % (i, author))
1318
 		f.write(", ".join(plots))
1319
 		f.write(", ".join(plots))
1319
 		f.write('\n')
1320
 		f.write('\n')
1320
 
1321
 
1341
 		plots = []
1342
 		plots = []
1342
 		for a in self.authors_to_plot:
1343
 		for a in self.authors_to_plot:
1343
 			i = i + 1
1344
 			i = i + 1
1344
-			plots.append("""'commits_by_author.dat' using 1:%d title "%s" w lines""" % (i, a.replace("\"", "\\\"")))
1345
+			author = a.replace("\"", "\\\"").replace("`", "")
1346
+			plots.append("""'commits_by_author.dat' using 1:%d title "%s" w lines""" % (i, author))
1345
 		f.write(", ".join(plots))
1347
 		f.write(", ".join(plots))
1346
 		f.write('\n')
1348
 		f.write('\n')
1347
 
1349