mitigation for CVE-2015-20107 (paul-nameless#271)

Fixes: paul-nameless#270 Co-authored-by: Kevin Chan <[email protected]>
proycon · Aug 8, 2022 · 2b0c0cf · 2b0c0cf
1 parent 49981d1
commit 2b0c0cf
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/tg/utils.py b/tg/utils.py
@@ -85,7 +85,7 @@ def get_file_handler(file_path: str) -> str:
         return config.DEFAULT_OPEN.format(file_path=shlex.quote(file_path))
 
     caps = get_mailcap()
-    handler, view = mailcap.findmatch(caps, mtype, filename=file_path)
+    handler, view = mailcap.findmatch(caps, mtype, filename=shlex.quote(file_path))
     if not handler:
         return config.DEFAULT_OPEN.format(file_path=shlex.quote(file_path))
     return handler