summaryrefslogtreecommitdiff
path: root/Documentation/core-api
diff options
context:
space:
mode:
authorVegard Nossum <vegard.nossum@oracle.com>2024-01-10 20:47:58 +0300
committerJonathan Corbet <corbet@lwn.net>2024-01-11 19:21:01 +0300
commitc48a7c44a1d02516309015b6134c9bb982e17008 (patch)
treec0900d3847622612f2b913f0071b1b78bb7ec928 /Documentation/core-api
parent1f4cac0f7465830a17a266983acbd60a2ce7ee6f (diff)
downloadlinux-c48a7c44a1d02516309015b6134c9bb982e17008.tar.xz
docs: kernel_feat.py: fix potential command injection
The kernel-feat directive passes its argument straight to the shell. This is unfortunate and unnecessary. Let's always use paths relative to $srctree/Documentation/ and use subprocess.check_call() instead of subprocess.Popen(shell=True). This also makes the code shorter. This is analogous to commit 3231dd586277 ("docs: kernel_abi.py: fix command injection") where we did exactly the same thing for kernel_abi.py, somehow I completely missed this one. Link: https://fosstodon.org/@jani/111676532203641247 Reported-by: Jani Nikula <jani.nikula@intel.com> Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com> Cc: stable@vger.kernel.org Signed-off-by: Jonathan Corbet <corbet@lwn.net> Link: https://lore.kernel.org/r/20240110174758.3680506-1-vegard.nossum@oracle.com
Diffstat (limited to 'Documentation/core-api')
0 files changed, 0 insertions, 0 deletions