Repository: git-big-picture/git-big-picture (language: python)

Issue:
For safety, stop using shlex.split (outside of tests)



Discussion / hints:

Fix patch:
diff --git a/git-big-picture b/git-big-picture
index d654a79..3907c7c 100755
--- a/git-big-picture
+++ b/git-big-picture
@@ -844,7 +844,7 @@ class CommitGraph:
 
         def format_label(sha_one):
             if with_commit_messages:
-                output = self.git('git log -1 --pretty=format:%s ' + sha_one)
+                output = self.git(['git', 'log', '-1', '--pretty=format:%s', sha_one])
                 message = output[0].replace('"', '').replace('\'', '')
                 return format_sha_one(sha_one) + '\n' + message
             else:


Test patch:
diff --git a/test.scf b/test.scf
index 897163d..0ab2b1a 100755
--- a/test.scf
+++ b/test.scf
@@ -33,6 +33,10 @@ run without options
     2: fatal: Must provide an output option. Try '-h' for more information
     [8]
 
+cover including commit messsages (smoke test)
+    $ git-big-picture -c -g >/dev/null
+    [0]
+
 mix --graphviz and --processed and others
     $ git-big-picture -p -g
     2: fatal: Options '-g | --graphviz' and '-p | --processed' are mutually exclusive.