berberman / arch-hs

Distribute hackage packages to archlinux
MIT License
19 stars 4 forks source link

Description with backticks gets executed #51

Open james-callahan opened 2 years ago

james-callahan commented 2 years ago

I ran arch-hs to create haskell-nicify-lib and it generated a PKGBUILD with:

pkgdesc="Pretty print the standard output of default `Show` instances."

When building with aur build, this resulted in e.g.

/home/james/src/PKGBUILDs/fossa-cli/haskell-nicify-lib/PKGBUILD: line 8: Show: command not found

This implies a code execution security problem.