Use system2 to avoid shell injection
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 45/100
Research direction
Start at R/scaffold.R line 121, following the linked revision, and inspect how the pkg value reaches the shell command. Compare the existing call with R's system2() documentation. Done means the scaffold command no longer allows pkg to be interpreted as shell syntax while preserving its intended behavior; check any relevant scaffold workflow afterward.
Written by the indexing model from the issue text.
Description
IINM this could be subject to shell injection if pkg can be passed as an arbitrary input.
system2() should have roughly the same level of code complexity & avoids this issue
- Dominant language
- R
- Stars
- 801
- Forks
- 202
- PR merge metrics
- No merged PRs in 30d
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from ramnathv/htmlwidgets
-
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
ramnathv/htmlwidgets#307 · 2 reactions ·
-
Difficulty 3/5 1-2 days Newbie friendliness 52/100
ramnathv/htmlwidgets#495 · 1 reaction ·
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
ramnathv/htmlwidgets#492 · 2 comments ·
-
Difficulty 5/5 Over a week Newbie friendliness 20/100
ramnathv/htmlwidgets#489 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 35/100
ramnathv/htmlwidgets#488 · 1 comment ·
All issues in ramnathv/htmlwidgets
Similar issues
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
HenrikBengtsson/R.matlab#61 ·
-
multi_class that used on tutorial has been deprecated on sklearn 1.5 versionPossibly taken A pull request linked to this issue is open or already merged. Open
Difficulty 1/5 1-3 hours Newbie friendliness 72/100
microsoft/ML-For-Beginners#1059 · 1 comment ·
-
easy first-contributor first-contributors good first issue help wanted r up-for-grabs
Difficulty 1/5 Under an hour Newbie friendliness 92/100
fork-commit-merge/fork-commit-merge#8524 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
waldronlab/bedbaser#27 ·
-
documentation good first issue priority: low
Difficulty 1/5 Under an hour Newbie friendliness 88/100
Pascal-Kueng/dyadMLM#157 ·
Maintainers usually reply within 1 day