From 00487d455a10e074a4539a231a9b3028853a7334 Mon Sep 17 00:00:00 2001 From: dosire Date: Mon, 24 Mar 2014 12:04:43 +0100 Subject: [PATCH 1/2] References for the issues the guide addresses. --- doc/development/shell_commands.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/doc/development/shell_commands.md b/doc/development/shell_commands.md index 57b1172d5e6..63e58a63080 100644 --- a/doc/development/shell_commands.md +++ b/doc/development/shell_commands.md @@ -1,5 +1,11 @@ # Guidelines for shell commands in the GitLab codebase +## References + +- [Google Ruby Security Reviewer's Guide](https://code.google.com/p/ruby-security/wiki/Guide) +- [OWASP Command Injection](https://www.owasp.org/index.php/Command_Injection) +- [Ruby on Rails Security Guide](http://guides.rubyonrails.org/security.html) section 7.7 + ## Use File and FileUtils instead of shell commands Sometimes we invoke basic Unix commands via the shell when there is also a Ruby API for doing it. From 842c0d6b5f7a60a4e4523fe1faefaab5038c96eb Mon Sep 17 00:00:00 2001 From: dosire Date: Mon, 24 Mar 2014 14:31:35 +0100 Subject: [PATCH 2/2] Can deeplink after all. --- doc/development/shell_commands.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/doc/development/shell_commands.md b/doc/development/shell_commands.md index 63e58a63080..af0d5ca4426 100644 --- a/doc/development/shell_commands.md +++ b/doc/development/shell_commands.md @@ -4,7 +4,7 @@ - [Google Ruby Security Reviewer's Guide](https://code.google.com/p/ruby-security/wiki/Guide) - [OWASP Command Injection](https://www.owasp.org/index.php/Command_Injection) -- [Ruby on Rails Security Guide](http://guides.rubyonrails.org/security.html) section 7.7 +- [Ruby on Rails Security Guide Command Line Injection](http://guides.rubyonrails.org/security.html#command-line-injection) ## Use File and FileUtils instead of shell commands