Add comment about untrusted origin_cmd

9d12fa78 · Jacob Vosmaer · ca66ab51 · 9d12fa78
Commit 9d12fa78 authored Nov 26, 2015 by Jacob Vosmaer
Show whitespace changes
Inline Side-by-side

Showing with 3 additions and 0 deletions

lib/gitlab_shell.rb lib/gitlab_shell.rb +3 -0

No files found.
--- a/lib/gitlab_shell.rb
+++ b/lib/gitlab_shell.rb
@@ -17,6 +17,9 @@ class GitlabShell
    @repos_path = @config.repos_path
  end
+  # The origin_cmd variable contains UNTRUSTED input. If the user ran
+  # ssh git@gitlab.example.com 'evil command', then origin_cmd contains
+  # 'evil command'.
  def exec(origin_cmd)
    unless origin_cmd
      puts "Welcome to GitLab, #{username}!"