From b8506e8a3f7808ce72b8f050307157f9346e0a6a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Emmanuel=20BENO=C3=8ET?= Date: Sat, 20 Jul 2024 22:31:28 +0200 Subject: [PATCH] fix(matches): split command into arguments --- cmd/matches/extprogram.go | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/cmd/matches/extprogram.go b/cmd/matches/extprogram.go index cc85121..aa45dee 100644 --- a/cmd/matches/extprogram.go +++ b/cmd/matches/extprogram.go @@ -5,6 +5,7 @@ import ( "context" "io" "os/exec" + "strings" ) // streamObtainer refers to functions that may return either an input stream or @@ -72,7 +73,8 @@ func (pc *pipeCopy) abort() { // from both stderr and stdout to the dataPipe. func (pluginInst *matchesPlugin) readFromProgram(ctx context.Context, pipes *readerPipes) { go func() { - cmd := exec.Command(pluginInst.dataSource) //nolint:gosec // Command is in fact user-provided + args := strings.Split(pluginInst.dataSource, " ") + cmd := exec.Command(args[0], args[1:]...) //nolint:gosec // Command is in fact user-provided outs := startPipeCopy(func() (io.ReadCloser, error) { return cmd.StdoutPipe() }, pipes) defer outs.close()