/
niceSOFT
/
gzip
Обзор
Документация
Войти
/
niceSOFT
/
gzip
Код
Задачи
Вики
Пакеты
0
Релизы
0
Аналитика
Безопасность
master
tests/zdiff-abuse
33 строки
1 KB
Jim Meyering
tests: test for the latest fix
23 апр 2026, 06:51
23 апр 2026, 06:51
bd37163
Код
Авторство
О чём код?
#!/bin/sh # Ensure zdiff doesn't execute injected commands via -C option. # Before the fix, the eval in zdiff would execute arbitrary commands # when a crafted argument was passed to a short option like -C. # Copyright (C) 2026 Free Software Foundation, Inc. # This program is free software: you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation, either version 3 of the License, or # (at your option) any later version. # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # You should have received a copy of the GNU General Public License # along with this program. If not, see <https://www.gnu.org/licenses/>. . "${srcdir=.}/init.sh"; path_prepend_ .. echo x | gzip > a.gz || framework_failure_ cp a.gz b.gz || framework_failure_ fail=0 # Before the fix, this would run "id > hacked". zdiff -C "';id > hacked;'" a.gz b.gz 2>/dev/null; st=$? test -f hacked && fail=1 Exit $fail