Skip to content

Commit 9f50cca

Browse files
committed
shell=False
Changing shell=False and setting the popen args to a list, instead of a string disables shell injection as reported in CE-1479
1 parent 3a8b06b commit 9f50cca

3 files changed

Lines changed: 162 additions & 70 deletions

File tree

CHANGELOG.md

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,30 +1,42 @@
1+
### `2.0.17`
2+
3+
- fixed reported command injection vulnerability.
4+
15
### `2.0.16`
6+
27
- fixed reported command injection vulnerability.
38

49
### `2.0.15`
10+
511
- add `-X s3` to disable direct to S3 uploading
612

713
### `2.0.14`
14+
815
- fixed coverage combine
916

1017
### `2.0.13`
18+
1119
- fix encoding issues
1220

1321
### `2.0.12`
22+
1423
- revert merge commit fix, back to old way
1524

1625
### `2.0.11`
26+
1727
- fix merge commit when it's a pull request
1828
- remove snapci, business closed
1929
- skip vendor directories for gcov parsing
2030
- run coverage combine not merge
2131
- fix report encoding
2232

2333
### `2.0.10`
34+
2435
- fix uploading when reports contain characters outside of latin-1
2536
- remove reduced_redundancy header from
2637

2738
### `2.0.7`
39+
2840
- Add `--name/-n` to cli
2941
- Add support for Jenkins Blue
3042
- Fix environment variable joining
@@ -36,12 +48,15 @@
3648
- Support yaml:token and yaml:slug
3749

3850
### `2.0.5`
51+
3952
- Use `%20` for encoding spaces [appveyor] https://github.com/codecov/codecov-python/pull/66
4053

4154
### `2.0.4`
55+
4256
- fix detecting merge commits on all CI, not just Travis
4357

4458
### `2.0.3`
59+
4560
- add `-F` to flagging uploads [new feature]
4661
- fixed some reports ascii chars
4762
- added `--pr` flag for manually specifing pulls
@@ -55,97 +70,118 @@
5570
- hide token from stdout
5671

5772
### `1.6.4`
73+
5874
- fix gitlab project directory
5975
- fallback on git branch/commit
6076
- fix using gcov_exec
6177

6278
### `1.6.0`
79+
6380
- depreciate `--no-fail` now a default
6481
- add `--required` to fail the build if Codecov fails
6582
- added `--cacerts` for enterprise customers
6683
- added fix reports http://bit.ly/1O4eBpt
6784

6885
### `1.5.0`
86+
6987
- fix retreiving mercurial commit
7088
- add support for swift/xcode7 profdata
7189
- now uploading direct-to-s3 to improve product performance
7290
- not require branch, will default to `master` (the default branch)
7391
- fix drone.io commit number, which is not a full 40 sha.
7492

7593
### `1.4.1`
94+
7695
- added `--no-fail` to prevent failing builds when missing configuration or Codecov errors
7796

7897
### `1.4.0`
98+
7999
- Ignore other known bad files/paths
80100
- Added test suite to test against example repositories
81101
- Using `coverage xml -i` to ignore No source for code errors
82102
- Cleaned up command output with help and colors
83103
- Added `gcov` processing, see `codecov --help` for more info.
84104

85105
### `1.3.1`
106+
86107
- Ignore other known bad files/paths
87108
- Fix issue with decoding files in py3+
88109

89110
### `1.3.0`
111+
90112
- Refactor project to be a global uploader for more reports
91113

92114
### `1.2.3`
115+
93116
- Remove `test-results.xml`, not a coverage file
94117
- Add CircleCI container numbers
95118

96119
### `1.2.2`
120+
97121
- bring back client-side pre-processing for jacoco (they can crush)
98122

99123
### `1.2.1`
124+
100125
- accept any file ending in `coverge.xml`
101126

102127
### `1.2.0`
128+
103129
- accept `nosetests.xml` and `test-results.xml` files
104130
- no longer do client side pre-processing, upload raw
105131
- capture SEMAPHORE_CURRENT_THREAD
106132

107133
### `1.1.13`
134+
108135
- added --build arg for advanced usage
109136

110137
### `1.1.10`
138+
111139
- fix package for 2.6 on windows
112140
- fix showing `--help` when called in non-git backed repo
113141
- fix AppVeyor public repos
114142

115143
### `1.1.8`
144+
116145
- support GitLab CI Runner
117146
- added rollbar to help bugs if presented
118147
- added more filepath matching
119148
- pep8 cleanup
120149
- added Shippable ci
121150

122151
### `1.1.7`
152+
123153
- support for D lang added, special thanks to @ColdenCullen
124154
- Wercker CI supported by @Robpol86
125155
- fixed Drone build number
126156

127157
### `1.1.6`
158+
128159
- fix semaphore commit revision number
129160
- preprocess reports from xml
130161

131162
### `1.1.5`
163+
132164
- search for all `lcov|gcov` files
133165
- depreciate `--min-coverage`, use GitHub Status Update feature
134166
- pre-process xml => json
135167

136168
### `1.1.4`
169+
137170
- added support for pyhton 2.6 by @Robpol86
138171
- added AppVeyor support by @Robpol86
139172

140173
### `1.1.3`
174+
141175
- added more ignore paths
142176

143177
### `1.1.2`
178+
144179
- search for `lcov.info` files
145180
- pause for `.1` before checking for min-coverage
146181
- accept `--env` variables which are stored in front-end for build specs
147182

148183
### `1.1.1`
184+
149185
- build python coverage xml only when no reports found to fix overriding reports
150186
- now defaulting output to **plain text**. Use `--json` to return json results
151187
- added `jacocoTestReport.xml` to search list

0 commit comments

Comments
 (0)