diff options
| author | Dennis Fink | 2026-02-24 21:13:23 +0100 |
|---|---|---|
| committer | Dennis Fink | 2026-02-24 21:15:38 +0100 |
| commit | 63780c4c4b5a15b95631bab8abfe86fcd85fc9d0 (patch) | |
| tree | dd37714a9d4a18691f007fe1db335b5d434ad68a /transcode.sh.bash-completion | |
| parent | ba036285523e557c79fa96f4e2529379c162cde8 (diff) | |
| download | transcode.sh-63780c4c4b5a15b95631bab8abfe86fcd85fc9d0.tar.gz transcode.sh-63780c4c4b5a15b95631bab8abfe86fcd85fc9d0.zip | |
fix(preset): refuse to source world-writable preset files
Preset files are executed as shell code. A world-writable preset file
could be modified by any local user to inject arbitrary commands.
Symlinks are resolved before the permission check because stat on a
symlink returns the permissions of the link itself (always 777 on
Linux) rather than those of the target. readlink -f is used with a
fallback to realpath for macOS/BSD compatibility.
Diffstat (limited to 'transcode.sh.bash-completion')
0 files changed, 0 insertions, 0 deletions