f254af0459
Ensures all `cd` commands in Git deployment operations use properly escaped
directory paths via `escapeshellarg()` to prevent shell injection vulnerabilities
and handle special characters correctly.
**Changes:**
1. `setGitImportSettings()` method:
- Added `$escapedBaseDir` variable for consistent path escaping
- Replaced all 5 instances of `cd {$baseDir}` with `cd {$escapedBaseDir}`
- Affects: commit checkout, submodules, and LFS operations
2. `generateGitImportCommands()` method (deploy_key type):
- Replaced 3 instances in pull request handling for GitLab, GitHub/Gitea, Bitbucket
3. `generateGitImportCommands()` method (other type):
- Replaced 3 instances in pull request handling for GitLab, GitHub/Gitea, Bitbucket
**Security Impact:**
- Prevents shell injection from malicious directory paths
- Fixes parsing issues with special characters (@, ~, spaces)
- Consistent escaping across all deployment types: source, deploy_key, other
- Complements existing URL escaping for comprehensive security
**Testing:**
- All existing unit tests pass (5/5 Git ls-remote parsing tests)
- Code formatted with Laravel Pint
Co-Authored-By: Claude <noreply@anthropic.com>
|
||
|---|---|---|
| .. | ||
| Actions | ||
| Console | ||
| Contracts | ||
| Data | ||
| Enums | ||
| Events | ||
| Exceptions | ||
| Helpers | ||
| Http | ||
| Jobs | ||
| Listeners | ||
| Livewire | ||
| Models | ||
| Notifications | ||
| Policies | ||
| Providers | ||
| Repositories | ||
| Rules | ||
| Services | ||
| Support | ||
| Traits | ||
| View/Components | ||