diff options
| author | Paul Buetow <paul@buetow.org> | 2026-03-01 23:00:14 +0200 |
|---|---|---|
| committer | Paul Buetow <paul@buetow.org> | 2026-03-01 23:00:14 +0200 |
| commit | f9dd513d8cd70654b03bcb80e9b4897c2ef6f72b (patch) | |
| tree | dddd294154c31dc4b2b2495353f2e152c676a3ab /examples/cli | |
| parent | 7c439bef61b90e6744ac971a999262a0eeb76750 (diff) | |
fix: replace shell-interpolation with system() in DNFPackageManager
Backtick calls interpolated the package name directly into a shell
command string, allowing metacharacters (;, $(), backticks) to execute
arbitrary commands. Using system() with separate arguments bypasses the
shell entirely, so the package name is passed as a literal argv element
to dnf.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Diffstat (limited to 'examples/cli')
0 files changed, 0 insertions, 0 deletions