You're looking at it

Homepage: https://roundabout-host.com

Important information: Google announced that, from September 2026, Android devices will require ALL apps to be signed by Google, effectively leading to an iOS situation. Value your right to a computer that does what you want; do not tolerate this monopolistic practice! Contact me if you don't understand why it is bad. Click to learn more.

(security) fix shell injection by using the python quoter

by roundabout, Tuesday, 5 May 2026, 19:13:57 (1778008437), pushed by roundabout, Tuesday, 5 May 2026, 19:19:50 (1778008790)

Author identity: vlad <vlad.muntoiu@gmail.com>

4bd5f50b2b135f2c289e6380c9ced9a8228c77d7

app.py

@@ -990,8 +990,7 @@ def repository_tree(username, repository, branch, subpath):

                                
                                
                                
                            
                                
                                    
                                        
                                            
                                                        path = os.path.join(server_repo_location, file)
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            
                                                        mimetype = guess_mime(path)
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            
                                            
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                                    text = git_command(server_repo_location, None, "log", "--format='%H\n'",
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                                                       shlex.quote(file)).decode()
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                                    text = git_command(server_repo_location, None, "log", "--format=%H\n", file).decode()
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            
                                            
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            
                                                        sha = text.split("\n")[0]
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            
                                                        identifier = f"/{username}/{repository}/{sha}"
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        

@@ -1962,7 +1961,7 @@ def repository_log(username, repository, branch):

                                
                                
                                
                            
                                
                                    
                                        
                                            
                                            
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            
                                                commit_list = [f"/{username}/{repository}/{sha}" for sha in
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            
                                                               git_command(server_repo_location, None, "log",
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                                                       "--format='%H'").decode().split("\n")]
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                                                       "--format=%H").decode().split("\n")]
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            
                                            
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            
                                                commits = Commit.query.filter(Commit.identifier.in_(commit_list)).order_by(Commit.author_date.desc())
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            
                                                page_number = flask.request.args.get("page", 1, type=int)
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                            
                                

celery_tasks.py

@@ -50,7 +50,7 @@ def _get_foreign_commit_owner(server, repo_route, sha):

                                
                                
                                
                            
                                
                                    
                                        
                                            
                                            
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            
                                            def parse_commit(directory, repo_route, sha, pusher, owner_name=None):
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            
                                                from models import User, Repo, Commit
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            commit_info = common.git_command(directory, b"", "show", "-s", "--format='%H%n%at%n%cn <%ce>%n%B'", sha).strip().decode()
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            commit_info = common.git_command(directory, b"", "show", "-s", "--format=%H%n%at%n%cn <%ce>%n%B", sha).strip().decode()
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            
                                            
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            
                                                sha, time, identity, body = commit_info.split("\n", 3)
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            
                                            
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        

@@ -184,9 +184,9 @@ def merge_heads(head_route, head_branch, base_route, base_branch, pr_id, simulat

                                
                                
                                
                            
                                
                                    
                                        
                                            
                                                        # Add the merge commit.
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            
                                                        if method == "merge":
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            
                                                            last_commit = common.git_command(server_repo_location, b"", "log",
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                                                                         "--pretty=format:\"%H\"", "-n", "1").strip().decode()
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                                                                         "--pretty=format:%H", "-n", "1").strip().decode()
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            
                                                            last_commit_info = common.git_command(server_repo_location, b"", "show", "-s",
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                                                                              "--format='%H%n%at%n%cn <%ce>%n%B'",
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                                                                              "--format=%H%n%at%n%cn <%ce>%n%B",
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            
                                                                                                  last_commit).strip().decode()
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            
                                            
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            
                                                            if not db.session.get(Commit, f"{base_route}/{last_commit}"):
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        

@@ -197,7 +197,7 @@ def merge_heads(head_route, head_branch, base_route, base_branch, pr_id, simulat

                                
                                
                                
                            
                                
                                    
                                        
                                            
                                                                                    db.session.get(User, username))
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            
                                                                    db.session.add(commit)
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            
                                                        elif method == "rebase":
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                                        new_commits = common.git_command(server_repo_location, b"", "log", "--pretty=format:\"%H\"",
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                                        new_commits = common.git_command(server_repo_location, b"", "log", "--pretty=format:%H",
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            
                                                                                            f"{old_head_commit}..heads/{head_branch}", "--").decode().splitlines()
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            
                                            
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            
                                                            # Copy the commit rows from the head repo to the base repo.
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        

@@ -265,16 +265,16 @@ def merge_heads(head_route, head_branch, base_route, base_branch, pr_id, simulat

                                
                                
                                
                            
                                
                                    
                                        
                                            
                                                        common.git_command(server_repo_location, b"", "rebase", "--abort")
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            
                                                else:
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            
                                                    if method == "merge":
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                                    new_commits = common.git_command(server_repo_location, b"", "log", "--pretty=format:\"%H\"", f"heads/{base_branch}..NEW/{head_branch}", "--").decode().splitlines()
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                                    new_commits = common.git_command(server_repo_location, b"", "log", "--pretty=format:%H", f"heads/{base_branch}..NEW/{head_branch}", "--").decode().splitlines()
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            
                                                        part_out, part_err, merge_exit = common.git_command(server_repo_location, b"", "merge", "--allow-unrelated-histories",
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            
                                                                                                            "--no-ff", f"NEW/{head_branch}", return_err=True, return_exit=True)
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            
                                                    elif method == "fast-forward":
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                                    new_commits = common.git_command(server_repo_location, b"", "log", "--pretty=format:\"%H\"", f"heads/{base_branch}..NEW/{head_branch}", "--").decode().splitlines()
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                                    new_commits = common.git_command(server_repo_location, b"", "log", "--pretty=format:%H", f"heads/{base_branch}..NEW/{head_branch}", "--").decode().splitlines()
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            
                                                        part_out, part_err, merge_exit = common.git_command(server_repo_location, b"", "merge", "--ff-only", f"NEW/{head_branch}", return_err=True, return_exit=True)
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            
                                                    elif method == "rebase":
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            
                                                        old_head_commit = common.git_command(server_repo_location, b"", "rev-parse", f"heads/{head_branch}")
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            
                                                        part_out, part_err, merge_exit = common.git_command(server_repo_location, b"", "rebase", f"NEW/{head_branch}", return_err=True, return_exit=True)
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                                    new_commits = common.git_command(server_repo_location, b"", "log", "--pretty=format:\"%H\"", f"{old_head_commit}..heads/{head_branch}", "--").decode().splitlines()
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                                    new_commits = common.git_command(server_repo_location, b"", "log", "--pretty=format:%H", f"{old_head_commit}..heads/{head_branch}", "--").decode().splitlines()
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            
                                            
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            
                                                    # Copy the commit rows from the head repo to the base repo.
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            
                                                    if "@" not in head_user:
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        

@@ -303,8 +303,8 @@ def merge_heads(head_route, head_branch, base_route, base_branch, pr_id, simulat

                                
                                
                                
                            
                                
                                    
                                        
                                            
                                            
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            
                                                    # Add the merge commit.
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            
                                                    if method == "merge":
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                                    last_commit = common.git_command(server_repo_location, b"", "log", "--pretty=format:\"%H\"", "-n", "1").strip().decode()
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                                    last_commit_info = common.git_command(server_repo_location, b"", "show", "-s", "--format='%H%n%at%n%cn <%ce>%n%B'", last_commit).strip().decode()
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                                    last_commit = common.git_command(server_repo_location, b"", "log", "--pretty=format:%H", "-n", "1").strip().decode()
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                                    last_commit_info = common.git_command(server_repo_location, b"", "show", "-s", "--format=%H%n%at%n%cn <%ce>%n%B", last_commit).strip().decode()
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            
                                                        err += part_err
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            
                                            
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            
                                                        if not db.session.get(Commit, f"{base_route}/{last_commit}"):
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        

@@ -433,7 +433,7 @@ def apply_patch(route, branch, patch_content, current_username):

                                
                                
                                
                            
                                
                                    
                                        
                                            
                                                        print("Aborted because the patch doesn't apply")
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            
                                                        return "apply_patch", False
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            
                                            
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            new_commits = git_command(server_repo_location, b"", "log", "--pretty=format:\"%H\"",
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            new_commits = git_command(server_repo_location, b"", "log", "--pretty=format:%H",
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            
                                                                                 f"{old_head_commit}..HEAD",
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            
                                                                                 "--").decode().split("\n")
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            
                                                # Copy the commit rows from the head repo to the base repo.
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                            
                                

common.py

@@ -29,7 +29,7 @@ def git_command(repo, data, *args, return_err=False, return_exit=False):

                                
                                
                                
                            
                                
                                    
                                        
                                            
                                            
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            
                                                command = ["git", *args]
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            
                                            
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            proc = subprocess.Popen(" ".join(command), cwd=repo, env=env, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            proc = subprocess.Popen(command, cwd=repo, env=env, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            
                                                                        stdin=subprocess.PIPE)
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            
                                            
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            
                                                if data:
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                            
                                

git_http.py

@@ -104,7 +104,7 @@ def git_receive_pack(username, repository):

                                
                                
                                
                            
                                
                                    
                                        
                                            
                                            
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            
                                                for sha in reversed(commits_list):
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            
                                                    info = git_command(server_repo_location, None, "show", "-s",
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                                                   "--format='%H%n%at%n%cn <%ce>%n%B'", sha).decode()
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                                                   "--format=%H%n%at%n%cn <%ce>%n%B", sha).decode()
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            
                                            
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            
                                                    sha, time, identity, body = info.split("\n", 3)
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            
                                                    login = flask.g.user