mirror of
https://github.com/openwrt/openwrt.git
synced 2026-10-14 13:08:30 +04:00
Peter Polonec
56c6654957
[backport from Debian zip 3.0-16] https://sources.debian.org/data/main/z/zip/3.0-16/debian/patches/fix-command-injection.patch Info-ZIP 3.0 builds a shell command with the archive name when -T tests an archive. A crafted archive name can inject additional shell commands. Backport Debian's fix. Quote the archive name before it is added to the test command. Link: https://sintonen.fi/advisories/infozip-test-option-command-injection.txt Signed-off-by: Peter Polonec <polonec.devel@pm.me> Link: https://github.com/openwrt/openwrt/pull/24730 Signed-off-by: Robert Marko <robimarko@gmail.com>