Compare commits

...

3 Commits

Author SHA1 Message Date
Robin Candau
0ce651857c Merge branch 'exit_on_nvchecker_cmd_source' into 'master'
fix(version): Fail if the 'cmd' source is used in .nvchecker.toml

See merge request archlinux/devtools!295
2025-08-09 11:54:31 +02:00
Jakub Klinkovský
fc56ebedf3 fix(completion): fix bash completion for the license subcommand
Signed-off-by: Jakub Klinkovský <lahwaacz@archlinux.org>
2025-08-05 17:48:12 +02:00
Robin Candau
cfb99fd2d8 fix(version): Fail if the 'cmd' source is used in .nvchecker.toml
The [cmd](https://nvchecker.readthedocs.io/en/latest/usage.html#find-with-a-command) source allows nvchecker to use a shell command line to get versions. Using this source within `.nvchecker.toml` would result in `pkgctl version {check,upgrade}` to run arbitrary commands which isn't desirable, as it can lead to various issues (e.g. missing packages / dependencies to run said commands or even executing malicious commands in hypothetical worst case scenarios)
2025-01-04 12:25:32 +01:00
2 changed files with 7 additions and 0 deletions

View File

@@ -150,6 +150,7 @@ _pkgctl_cmds=(
db
diff
issue
license
release
repo
search

View File

@@ -350,6 +350,12 @@ nvchecker_check_config() {
printf "non-pkgbase section not supported in %s: %s" "${config}" "${property}"
return 1
fi
# check if the config is using the 'cmd' source
if grep --extended-regexp --quiet '^\s*source\s*=\s*["'\'']cmd["'\'']\s*$' "${config}"; then
printf "using the 'cmd' source in %s is disallowed" "${config}"
return 1
fi
}
nvchecker_check_error() {