mirrors/qBittorrent
1
0
Fork 0
mirror of https://github.com/qbittorrent/qBittorrent.git synced 2024-11-28 05:27:15 +03:00
Code Issues Projects Releases Packages Wiki Activity

Prevent command injection via "Run external program" function

Browse source 
Closes #10925.
This commit is contained in:
Chocobo1 2019-07-18 22:36:40 +08:00
parent 7f3291c3de
commit a610c8567e
No known key found for this signature in database
GPG key ID: 210D9C873253A68C
1 changed files with 5 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
src/app/application.cpp
View file

@ -335,7 +335,11 @@ void Application::runExternalProgram(const BitTorrent::TorrentHandle *torrent) c
::LocalFree(args);
#else
QProcess::startDetached(QLatin1String("/bin/sh"), {QLatin1String("-c"), program});
// Cannot give users shell environment by default, as doing so could
// enable command injection via torrent name and other arguments
// (especially when some automated download mechanism has been setup).
// See: https://github.com/qbittorrent/qBittorrent/issues/10925
QProcess::startDetached(program);
#endif
}