[PR #600] [MERGED] fix!: Shell escape in entitlement handling #1670

New issue

Closed

opened 2026-03-03 19:08:19 +03:00 by kerem · 0 comments

kerem commented

2026-03-03 19:08:19 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/PlayCover/PlayCover/pull/600
Author: @ohaiibuzzle
Created: 12/20/2022
Status: ✅ Merged
Merged: 12/20/2022
Merged by: @Depal1

Base: develop ← Head: fix/emerg-entitlement-escape

📝 Commits (1)

87bf607 fix!: Shell escape in entitlement handling

📊 Changes

1 file changed (+1 additions, -1 deletions)

View changed files

📝 PlayCover/Utils/PlayTools.swift (+1 -1)

📄 Description

A bug was discovered that allows arbitrary command execution when running an app from PlayCover due to the code dealing with parsing entitlements did not escape the app path.

Bug was introduced in 84ce798269, so it may have affected all PlayCover versions past v1.0.7

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/PlayCover/PlayCover/pull/600 **Author:** [@ohaiibuzzle](https://github.com/ohaiibuzzle) **Created:** 12/20/2022 **Status:** ✅ Merged **Merged:** 12/20/2022 **Merged by:** [@Depal1](https://github.com/Depal1) **Base:** `develop` ← **Head:** `fix/emerg-entitlement-escape` --- ### 📝 Commits (1) - [`87bf607`](https://github.com/PlayCover/PlayCover/commit/87bf607fba87af141a52212939e22d5ef5d15d8d) fix!: Shell escape in entitlement handling ### 📊 Changes **1 file changed** (+1 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `PlayCover/Utils/PlayTools.swift` (+1 -1) </details> ### 📄 Description A bug was discovered that allows arbitrary command execution when running an app from PlayCover due to the code dealing with parsing entitlements did not escape the app path. Bug was introduced in 84ce798269, so it may have affected all PlayCover versions past v1.0.7 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>