P1bubandCarlo Sala d42209f2af fix(installer): prevent command injection via $USER in install.sh (#13960) ...

HOME="${HOME:-$(eval echo ~"$USER")}" expands any shell metacharacters in
$USER when HOME is unset (CWE-78), e.g. USER='x"; <command>; "'. Validate the
username against a safe character set before running the eval and fall back
to $PWD for unsafe values. Also quote $USER in the getent call to avoid word
splitting.

Co-authored-by: Carlo Sala <carlosalag@protonmail.com>

2026-08-20 10:43:07 +02:00

..

changelog.sh

fix(core): add Ghostty OSC 8 support (#13961)

2026-08-20 10:18:07 +02:00

check_for_upgrade.sh

fix(check_for_upgrade): ensure compatibility with screen (#13302)

2025-09-19 15:47:45 +02:00

install.sh

fix(installer): prevent command injection via $USER in install.sh (#13960)

2026-08-20 10:43:07 +02:00

require_tool.sh

chore(docs): fix some typos (#11211)

2022-10-03 17:03:53 +02:00

theme_chooser.sh

fix(theme-chooser): use env in shebang (#12720)

2024-10-03 10:47:33 +02:00

uninstall.sh

fix(uninstall): abort uninstall if unable to change shell (#10357)

2023-03-23 14:34:43 +01:00

upgrade.sh

fix(core): add Ghostty OSC 8 support (#13961)

2026-08-20 10:18:07 +02:00