Repository navigation
Fix shell escaping issues - #1341
Open
Marcel Laverdet (laverdet) wants to merge 1 commit into
Open
Marcel Laverdet (laverdet) wants to merge 1 commit into
Marcel Laverdet (laverdet) wants to merge 1 commit into
Conversation
Note that this is not a comprehensive audit of this project. I've only looked at this one file. Fixes devcontainers#1324
Author
|
@microsoft-github-policy-service agree |
Author
|
Oh yeah also please note that this would be a breaking change for users who expect $VARIABLES to be expanded on the container side. On the other hand, the existing behavior is plainly broken and potentially a security issue. Feature developers who want the value expanded can easily pass this off to |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Maybe some of these values are considered "safe" already (container username, so on) but it sets a bad precedent to escape in some places and not others. Quote escaping is not a matter of safe vs unsafe (since escaping may be nested, i.e. if you had JSON in an environment variable), it is a matter of correct vs incorrect. Safety is the byproduct of that.
Also note that I didn't do a full end to end test of this or setup a full fledged devcontainer distribution for development. The changes are straightforward so I'm shooting from the hip.
Note that this is not a comprehensive audit of this project. I've only looked at this one file.
Fixes #1324