Skip to content

Commit 0643a6f

Browse files
committed
travisify.sh: quote repoSlug variable
It is conceivable, though highly unlikely, that the repoSlug extracted from the pom.xml will have whitespace, and/or be somehow antagonistally formed. So best practice security-wise is to quote it.
1 parent 84cd8e4 commit 0643a6f

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

travisify.sh

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -166,7 +166,7 @@ EOL
166166
'#'*) continue;;
167167
esac
168168
info "Encrypting ${p%%=*}"
169-
echo yes | $EXEC travis encrypt "$p" --add env.global --repo $repoSlug
169+
echo yes | $EXEC travis encrypt "$p" --add env.global --repo "$repoSlug"
170170
done <"$varsFile"
171171
$EXEC git commit "$travisConfig" -m "Travis: add encrypted environment variables"
172172
else
@@ -179,7 +179,7 @@ EOL
179179
info "Encrypting $signingKeyDestFile"
180180
# NB: We have to copy the file first, so that --add does the right thing.
181181
$EXEC cp "$signingKeySourceFile" "$signingKeyDestFile"
182-
$EXEC travis encrypt-file "$signingKeyDestFile" "$signingKeyDestFile.enc" --add --repo $repoSlug
182+
$EXEC travis encrypt-file "$signingKeyDestFile" "$signingKeyDestFile.enc" --add --repo "$repoSlug"
183183
$EXEC rm -f "$signingKeyDestFile"
184184
$EXEC git add "$travisConfig" "$signingKeyDestFile.enc"
185185
$EXEC git commit -m "Travis: add encrypted GPG signing keypair"

0 commit comments

Comments
 (0)