github/Bose-SoundTouch
1
0
Fork 0
mirror of https://github.com/gesellix/Bose-SoundTouch.git synced 2026-08-18 08:36:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

sec8: document Run() invariant — command must never come from user HTTP input

Browse Source 
Establishes the constraint in godoc so future authors have a visible
signal before passing user-supplied values to session.CombinedOutput.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Tobias Gesellchen
2026-05-25 21:01:01 +02:00
co-authored by Claude Sonnet 4.6
parent 1cbca1e7cc
commit 6f488c2016
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/ssh/ssh.go
+3
View File
@@ -67,6 +67,9 @@ func (c *Client) getConfig() *ssh.ClientConfig {
}
// Run executes a command on the remote host and returns the combined stdout and stderr.
//
// command MUST be a hardcoded shell literal or constructed entirely from
// internal, service-controlled values — never from user-supplied HTTP input.
func (c *Client) Run(command string) (string, error) {
config := c.getConfig()