1. 13 Dec, 2021 11 commits
  2. 07 Dec, 2021 4 commits
  3. 02 Dec, 2021 1 commit
  4. 01 Dec, 2021 5 commits
  5. 30 Nov, 2021 2 commits
  6. 27 Nov, 2021 3 commits
  7. 25 Nov, 2021 3 commits
  8. 17 Nov, 2021 7 commits
  9. 16 Nov, 2021 2 commits
  10. 11 Nov, 2021 2 commits
    • Marc Cornellà's avatar
      fix(themes): fix potential command injection in `pygmalion`, `pygmalion-virtualenv` and `refined` · b3ba9978
      Marc Cornellà authored
      The pygmalion and pygmalion-virtualenv themes unsafely handle git prompt information
      which results in a double evaluation of this information, so a malicious git repository
      could trigger a command injection if the user cloned and entered the repository.
      
      A similar method could be used in the refined theme. All themes have been patched against this
      vulnerability.
      b3ba9978
    • Marc Cornellà's avatar
      fix(plugins): fix potential command injection in `rand-quote` and `hitokoto` · 72928432
      Marc Cornellà authored
      The `rand-quote` plugin uses quotationspage.com and prints part of its content to the
      shell without sanitization, which could trigger command injection. There is no evidence
      that this has been exploited, but this commit removes all possibility for exploit.
      
      Similarly, the `hitokoto` plugin uses the hitokoto.cn website to print quotes to the
      shell, also without sanitization. Furthermore, there is also no evidence that this has
      been exploited, but with this change it is now impossible.
      72928432