summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorXi Lu <lx@shellcodes.org>2023-02-18 18:03:28 +0800
committerIhor Radchenko <yantar92@posteo.net>2023-03-07 13:26:13 +0100
commit8f8ec2ccf3f5ef8f38d68ec84a7e4739c45db485 (patch)
tree98f92e8c7c222a1ed3abeb66a85add39f5f1987b
parent3d817c52c9588f5a2da0bd2cd955d7b0311a7f1c (diff)
downloadorg-mode-8f8ec2ccf3f5ef8f38d68ec84a7e4739c45db485.tar.gz
* lisp/ob-latex.el (org-babel-execute:latex): Fix command injection vulnerability
Link: https://orgmode.org/list/tencent_5C4D5D0DEFDDBBFC66F855703927E60C7706@qq.com TINYCHANGE
-rw-r--r--lisp/ob-latex.el2
1 files changed, 1 insertions, 1 deletions
diff --git a/lisp/ob-latex.el b/lisp/ob-latex.el
index 428907a..a0154bf 100644
--- a/lisp/ob-latex.el
+++ b/lisp/ob-latex.el
@@ -180,7 +180,7 @@ This function is called by `org-babel-execute-src-block'."
tmp-pdf
(list org-babel-latex-pdf-svg-process)
extension err-msg log-buf)))
- (shell-command (format "mv %s %s" img-out out-file)))))
+ (rename-file img-out out-file t))))
((string-suffix-p ".tikz" out-file)
(when (file-exists-p out-file) (delete-file out-file))
(with-temp-file out-file