{"comment":{"url":"https://api.github.com/repos/SiCKRAGETV/SickRage/comments/9487969","html_url":"https://github.com/SiCKRAGETV/SickRage/commit/a8787bc0d35990d47eee99e21c20689b6676b0b6#commitcomment-9487969","id":9487969,"user":{"login":"eli-jordan","id":326125,"avatar_url":"https://avatars.githubusercontent.com/u/326125?v=3","gravatar_id":"","url":"https://api.github.com/users/eli-jordan","html_url":"https://github.com/eli-jordan","followers_url":"https://api.github.com/users/eli-jordan/followers","following_url":"https://api.github.com/users/eli-jordan/following{/other_user}","gists_url":"https://api.github.com/users/eli-jordan/gists{/gist_id}","starred_url":"https://api.github.com/users/eli-jordan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/eli-jordan/subscriptions","organizations_url":"https://api.github.com/users/eli-jordan/orgs","repos_url":"https://api.github.com/users/eli-jordan/repos","events_url":"https://api.github.com/users/eli-jordan/events{/privacy}","received_events_url":"https://api.github.com/users/eli-jordan/received_events","type":"User","site_admin":false},"position":6,"line":346,"path":"sickbeard/helpers.py","commit_id":"a8787bc0d35990d47eee99e21c20689b6676b0b6","created_at":"2015-01-28T22:06:12Z","updated_at":"2015-01-28T22:06:12Z","body":"Technically yes. I'll admit I didn't think about that when writing the patch. However, it would require an attacker to have access to already have access to the file system, since srcFile and destFile are not direct user input, but rather files that have been located by sickrage scanning a directory. So a malicious filename could result in command injection, but the impact is minimal since the attacker requires machine access."}}