diff options
| author | GitLab Bot <gitlab-bot@gitlab.com> | 2020-02-11 21:08:44 +0000 |
|---|---|---|
| committer | GitLab Bot <gitlab-bot@gitlab.com> | 2020-02-11 21:08:44 +0000 |
| commit | 0e9eea40b62fcae67b2bd885dbedd7525fbca3c7 (patch) | |
| tree | 099467fd4c16441f60a879239056b235c7fdabdc /doc/development/shell_commands.md | |
| parent | 1ca9950d5f890cd8f185e1eda158b969a7244fe2 (diff) | |
| download | gitlab-ce-0e9eea40b62fcae67b2bd885dbedd7525fbca3c7.tar.gz | |
Add latest changes from gitlab-org/gitlab@master
Diffstat (limited to 'doc/development/shell_commands.md')
| -rw-r--r-- | doc/development/shell_commands.md | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/doc/development/shell_commands.md b/doc/development/shell_commands.md index 7079f7a9914..b8952cae33e 100644 --- a/doc/development/shell_commands.md +++ b/doc/development/shell_commands.md @@ -126,7 +126,7 @@ Note that unlike `Gitlab::Popen.popen`, `IO.popen` does not capture standard err ## Avoid user input at the start of path strings Various methods for opening and reading files in Ruby can be used to read the -standard output of a process instead of a file. The following two commands do +standard output of a process instead of a file. The following two commands do roughly the same: ```ruby @@ -138,7 +138,7 @@ The key is to open a 'file' whose name starts with a `|`. Affected methods include Kernel#open, File::read, File::open, IO::open and IO::read. You can protect against this behavior of 'open' and 'read' by ensuring that an -attacker cannot control the start of the filename string you are opening. For +attacker cannot control the start of the filename string you are opening. For instance, the following is sufficient to protect against accidentally starting a shell command with `|`: |