Inhibit arbitrary command execution in Docker post arguments

2026-04-23 18:48:49 -05:00 · 2018-03-16 20:07:09 +01:00
parent ac8a5b5984
commit 99b76766a0
1 changed files with 1 additions and 1 deletions
@@ -433,7 +433,7 @@ function xmlToCommand($xml, $create_paths=false) {
                 implode(' --device=', $Devices),
                 $xml['ExtraParams'],
                 escapeshellarg($xml['Repository']),
-                 $xml['PostArgs']);
+                 escapeshellarg($xml['PostArgs']));
  return [preg_replace('/\s+/', ' ', $cmd), $xml['Name'], $xml['Repository']];
 }