openwrtv3/package
Daniel Golle 267873ac9b
base-files: don't evaluate block-device uevent
Current code and also before commit da52dd0c83 was vulnerable to shell
injection using volume lables in the GPT partition table of block
devices. Given that partition names can be freely defined in GPT tables
we really shouldn't evaluate a string which is potentially crafted with
evil intentions. Hence rather use `export -n` to absorb the uevent's
variables into the environment.

Fixes commit da52dd0c83 (base-files: quote values when evaluating uevent)
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
[mschiffer@universe-factory.net: suggested export -n usage]
2018-02-13 00:01:44 +01:00
..
base-files base-files: don't evaluate block-device uevent 2018-02-13 00:01:44 +01:00
boot kexec-tools: bump version to 2.0.16 2018-02-11 16:10:51 +01:00
devel valgrind: Fix compile on ARM64 2018-02-10 20:17:43 +01:00
firmware ipq-wifi: drop OpenMesh A42 board-2.bin 2018-02-11 16:33:00 +01:00
kernel kernel: add IEEE-1284 parallel port support 2018-02-12 15:21:43 +01:00
libs bunwind: build for ARM64 2018-02-10 20:17:21 +01:00
network odhcp6c: fix appending of emtpy sendopt value (FS#1336) 2018-02-08 18:29:37 +01:00
system tools: add iucode-tool 2018-02-11 14:39:16 +01:00
utils build: add hardened builds with PIE (ASLR) support 2018-01-27 16:46:45 +01:00
Makefile build: remove package preconfig feature 2018-01-13 19:54:44 +01:00