{"action":"created","issue":{"url":"https://api.github.com/repos/reenhanced/gitreflow/issues/134","labels_url":"https://api.github.com/repos/reenhanced/gitreflow/issues/134/labels{/name}","comments_url":"https://api.github.com/repos/reenhanced/gitreflow/issues/134/comments","events_url":"https://api.github.com/repos/reenhanced/gitreflow/issues/134/events","html_url":"https://github.com/reenhanced/gitreflow/issues/134","id":108175340,"number":134,"title":"Command Injection in append_to_squashed_commit_message.","user":{"login":"dreid","id":48695,"avatar_url":"https://avatars.githubusercontent.com/u/48695?v=3","gravatar_id":"","url":"https://api.github.com/users/dreid","html_url":"https://github.com/dreid","followers_url":"https://api.github.com/users/dreid/followers","following_url":"https://api.github.com/users/dreid/following{/other_user}","gists_url":"https://api.github.com/users/dreid/gists{/gist_id}","starred_url":"https://api.github.com/users/dreid/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dreid/subscriptions","organizations_url":"https://api.github.com/users/dreid/orgs","repos_url":"https://api.github.com/users/dreid/repos","events_url":"https://api.github.com/users/dreid/events{/privacy}","received_events_url":"https://api.github.com/users/dreid/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-09-24T17:22:15Z","updated_at":"2015-09-28T19:41:41Z","closed_at":null,"body":"https://github.com/reenhanced/gitreflow/blob/master/lib/git_reflow/git_helpers.rb#L64\r\n\r\nThe message is interpolated into this command sequence causing variable and command substitution to happen in the shell.\r\n\r\nMost notably this causes commands in `backticks` found in the PR description to be executed upon `git reflow deliver`.\r\n\r\nMy suggestion in this particular case would be to just use the File api to construct the SQUASH_MSG file and avoid the shell entirely.\r\n\r\nHowever I'd also recommend auditing other uses of `run`. \r\n\r\nhttp://gavinmiller.io/2015/fixing-command-injection-vulnerabilities/ seems to be a pretty good resource."},"comment":{"url":"https://api.github.com/repos/reenhanced/gitreflow/issues/comments/143853820","html_url":"https://github.com/reenhanced/gitreflow/issues/134#issuecomment-143853820","issue_url":"https://api.github.com/repos/reenhanced/gitreflow/issues/134","id":143853820,"user":{"login":"dreid","id":48695,"avatar_url":"https://avatars.githubusercontent.com/u/48695?v=3","gravatar_id":"","url":"https://api.github.com/users/dreid","html_url":"https://github.com/dreid","followers_url":"https://api.github.com/users/dreid/followers","following_url":"https://api.github.com/users/dreid/following{/other_user}","gists_url":"https://api.github.com/users/dreid/gists{/gist_id}","starred_url":"https://api.github.com/users/dreid/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dreid/subscriptions","organizations_url":"https://api.github.com/users/dreid/orgs","repos_url":"https://api.github.com/users/dreid/repos","events_url":"https://api.github.com/users/dreid/events{/privacy}","received_events_url":"https://api.github.com/users/dreid/received_events","type":"User","site_admin":false},"created_at":"2015-09-28T19:41:41Z","updated_at":"2015-09-28T19:41:41Z","body":"That seems like a reasonable approach, thanks."}}