fix/security: prevent command injection on windows by evict · Pull Request #1272 · sourcegraph/src-cli
Navigation Menu
{{ message }}
sourcegraph / src-cli Public
- Notifications You must be signed in to change notification settings
- Fork 68
Conversation
Copy link Copy Markdown
Contributor
evict
commented
Mar 10, 2026
evict
commented
We should verify the result from the server, and make sure it's a URL. Additionally, the start pattern was dangerous and allows command injection, so we use OpenURL from url.dll directly.
evict added 2 commits
March 10, 2026 13:31
evict
requested review from
andreeleuterio,
burmudar and
cbrnrd
evict
self-assigned this
burmudar reviewed Mar 10, 2026
cmd/src/login_oauth.go
Show resolved
Hide resolved
cmd/src/login_oauth.go Show resolved Hide resolved
burmudar approved these changes Mar 10, 2026
burmudar reviewed Mar 10, 2026
cmd/src/login_oauth.go
Outdated
Show resolved
Hide resolved
cmd/src/login_oauth.go Outdated Show resolved Hide resolved
cbrnrd approved these changes Mar 10, 2026
evict
force-pushed
the
vr/security/prevent-command-injection
branch
from
089fa4b to
681ba1b
Compare
evict
force-pushed
the
vr/security/prevent-command-injection
branch
from
681ba1b to
2eb0830
Compare
evict
deleted the
vr/security/prevent-command-injection
branch
burmudar pushed a commit that referenced this pull request
Mar 23, 2026(cherry picked from commit 22191a7)
burmudar pushed a commit that referenced this pull request
Mar 23, 2026(cherry picked from commit 22191a7)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
3 participants