ShellEscape aint always escaping shells
Open
Ruby
- Dominant language
- CodeQL
- Stars
- 10.1k
- Forks
- 2.1k
- Avg merge
- 2d 15h
- Merged PRs (30d)
- 141
Description
Hey,
Does not this line mean if a user has defined a dummy function called shellescape() would be considered as a valid sanitizer ?
https://github.com/github/codeql/blob/e02affd327603e89519b67ceffc7e60948831cc1/ruby/ql/lib/codeql/ruby/security/CommandInjectionCustomizations.qll#L53
Thank you
Contributor guide
Assessment
This issue has not been assessed yet.