archive: fix command injection
1 files changed, 1 insertions(+), 0 deletions(-) M gitsrht/blueprints/repo.py
M gitsrht/blueprints/repo.py => gitsrht/blueprints/repo.py +1 -0
@@ 427,6 427,7 @@ def archive(owner, repo, ref): "archive", "--format=tar.gz", "--prefix", f"{repo.name}-{refname}/", + "--", ref ] subp = subprocess.Popen(args, stdout=subprocess.PIPE, stderr=sys.stderr)