zeppelin
zeppelin copied to clipboard
[HOTFIX] Escape envs when using `.conf`
What is this PR for?
Escaping envs to avoid malicious code in envs
What type of PR is it?
Hot Fix
Todos
- [ ] - Task
What is the Jira issue?
N/A
How should this be tested?
- Add shell commends inside envs
- It shouldn't be executed
Screenshots (if appropriate)
Questions:
- Does the license files need to update? No
- Is there breaking changes for older versions? No
- Does this needs documentation? No
ping @zjffdu @Reamer @huage1994 This code will change some malicious code like
$ printf %q ';whoami > /tmp/imp.log; date >>/tmp/imp.log;'
\;whoami\ \>\ /tmp/imp.log\;\ date\ \>\>/tmp/imp.log\;%