Skip to content
Snippets Groups Projects

Use the array syntax for shelling out

Merged Dominic Couture requested to merge dcouture-popen-args into master
All threads resolved!

What does this MR do and why?

Adds defense in depth to a previous fix. If validations are bypassed now the worst possible impact would be argument injection rather than a full command injection.

Screenshots or screen recordings

These are strongly recommended to assist reviewers and reduce the time to merge your change.

How to set up and validate locally

  1. Run Feature.enable(:bulk_import_projects) in your rails console
  2. Follow this documentation to use bulk import

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Vasilii Iakliushin

Merge request reports

Loading
Loading

Activity

Filter activity
  • Approvals
  • Assignees & reviewers
  • Comments (from bots)
  • Comments (from users)
  • Commits & branches
  • Edits
  • Labels
  • Lock status
  • Mentions
  • Merge request status
  • Tracking
Please register or sign in to reply
Loading