denisidoro/navi

Some concerns about security with variables

オープン

#533 opened on 2021/04/21

 (7 件のコメント) (1 件のリアクション) (0 人の担当者)Rust (559 件のフォーク)batch import
help wantednew feature

Repository metrics

Stars
 (17,474 個のスター)
PR merge metrics
 (PR metrics pending)

説明

Navi is really nice and the ability to use cheatsheet from other people is very nice and allows to learn new tricks. The use of variable with fzf is a real usability gain.

But those two features together raises some security concerns, as it may leads a navi user to run malicious or erroneous shell commands with unwanted side effects.

I'm afraid I've no solution apart disabling variables or setting up a mechanism which would allows only accepted and reviewed code to be executed.

コントリビューターガイド