better approch for fixing the remote shell exploit

1 files changed, 7 insertions, 1 deletions

diff --git a/bzr.rb b/bzr.rb
index c3f4190..2796e6c 100644
--- a/bzr.rb
+++ b/bzr.rb
@@ -21,6 +21,12 @@ class VCS
 	end
 
 	def VCS.commit comment
-		`#{BZRCMD} commit -m \"#{comment}\"`
+		tmpfile = "/tmp/commitcomment.#{rand(10000)}"
+		File.open(tmpfile,"w"){|f|
+			f<<comment
+		}
+		ret = `#{BZRCMD} commit -F #{tmpfile}`
+		File.delete(tmpfile)
+		ret
 	end
 end