navigine/bat
1
0 Fork 0
mirror of https://github.com/sharkdp/bat.git synced 2026-10-30 10:06:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix command injection in LESS template

Browse Source
This commit is contained in:
curious-rabbit committed 2026-05-06 00:46:35 +02:00
1 parent baebdd1789
commit c437ad4d27
2 files changed
+64 -4
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

CHANGELOG.md
+1
View File
@@ -22,6 +22,7 @@
- Syntax highlighting for Python files using uv as script runner in shebang #3689 (@janlarres)
## Bugfixes
- Quote filenames before substituting them into `$LESSOPEN` / `$LESSCLOSE` templates, preventing shell injection when a filename contains shell metacharacters, see #3726 (@curious-rabbit)
- Fix `--list-themes` unconditionally probing the terminal via OSC 10/11 even when `--theme` was set to an explicit value, see #3700 (regression introduced in bc42149a). (@optimistiCli)
- Fix inverted `$LESSCLOSE` warning so bat warns on nonzero exit, not on success. See #3654 (@cuiweixie)
- Sanitize control characters in filenames before displaying them in the file header, error messages, and the terminal title, preventing ANSI escape injection via crafted filenames. Closes #3054, see #3691 (@curious-rabbit)